CVE-2026-35379

Executive Summary

CVE-2026-35379 identifies a logic error in the tr utility of the uutils coreutils project. The vulnerability causes the [:graph:] and [:print:] POSIX character classes to be incorrectly defined. Specifically, the ASCII space character (0x20) is mistakenly included in [:graph:] and excluded from [:print:], reversing the standard behavior established by POSIX and GNU coreutils. This flaw can lead to unintended data modification or loss when tr is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command intended to delete all graphical characters while preserving whitespace will incorrectly delete all ASCII spaces, potentially causing data corruption or logic failures in downstream processing.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is a Rust-based reimplementation of GNU coreutils. It is distributed via package managers like cargo (crates.io) and potentially through system package managers for Linux distributions. The flaw is in the tr utility, a core component used in many scripts and pipelines. An incorrect implementation of character classes can break data processing workflows, leading to data loss or corruption. Users relying on uutils coreutils in CI/CD pipelines, data processing, or any automated text manipulation are at risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
• Base Score: 3.3 (Low)
• Attack Vector (AV): Local (AV:L) - The attacker must have local access to execute the tr command.
• Attack Complexity (AC): Low (AC:L) - No special conditions are required.
• Privileges Required (PR): None (PR:N) - No privileges needed to run tr.
• User Interaction (UI): Required (UI:R) - A user must run the vulnerable command.
• Scope (S): Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality (C): None (C:N) - No data exposure.
• Integrity (I): Low (I:L) - Data can be modified (e.g., spaces deleted).
• Availability (A): Low (A:L) - Data loss can affect availability of processed data.

Threat Level: Low. Exploitation requires local access and user interaction. The impact is limited to data integrity and availability in specific use cases.

Deep Dive & Mechanics

The tr utility translates or deletes characters. It supports POSIX character classes like [:graph:] (all printable characters except space) and [:print:] (all printable characters including space). The vulnerability stems from a logic error in the Rust implementation of these classes.

Root Cause: In the uutils tr implementation, the code that defines the [:graph:] and [:print:] classes incorrectly handles the space character (0x20). Instead of following the POSIX standard:

• [:graph:] should include all printable characters except space.
• [:print:] should include all printable characters including space.

The flawed implementation:

• Includes space (0x20) in [:graph:].
• Excludes space (0x20) from [:print:].

This reversal means that any operation using these classes will produce incorrect results. For example:

• tr -d '[:graph:]' will delete spaces, which is not the intended behavior (it should delete all graphical characters but keep spaces).
• tr -d '[:print:]' will keep spaces, which is also incorrect (it should delete all printable characters including spaces).

Impact on Scripts: Many scripts and data pipelines rely on these character classes for sanitization, validation, or transformation. A script that uses tr -d '[:graph:]' to remove non-whitespace characters will inadvertently remove all spaces, potentially merging words or breaking data formats (e.g., CSV, JSON, log files).

Vulnerable vs. Patched Code

The vulnerable code is in the tr utility's character class definition. The exact code is not provided, but the logic error can be described.

Vulnerable Logic (Conceptual):

// Flawed: includes space in graph, excludes from print
fn is_graph(c: u8) -> bool {
    c >= 0x21 && c <= 0x7E || c == 0x20  // Incorrectly includes space
}

fn is_print(c: u8) -> bool {
    c >= 0x20 && c <= 0x7E && c != 0x20  // Incorrectly excludes space
}

Patched Logic (Conceptual):

// Correct: follows POSIX standard
fn is_graph(c: u8) -> bool {
    c >= 0x21 && c <= 0x7E  // Excludes space
}

fn is_print(c: u8) -> bool {
    c >= 0x20 && c <= 0x7E  // Includes space
}

The patch ensures that [:graph:] excludes space (0x20) and [:print:] includes it.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system with uutils coreutils installed (vulnerable version).
• Ability to execute commands.

Exploitation Scenario: An attacker can craft a script or trick a user into running a command that uses the vulnerable tr with [:graph:] or [:print:] classes. For example, a malicious script that claims to clean up log files could use tr -d '[:graph:]' to delete all graphical characters, but it will also delete spaces, corrupting the data.

Proof of Concept (PoC):

# Create a test file with spaces and graphical characters
echo "Hello World 123" > test.txt

# Vulnerable behavior: deleting graphical characters also deletes spaces
tr -d '[:graph:]' < test.txt
# Expected output (correct): " " (only space remains)
# Actual output (vulnerable): "" (nothing remains, spaces deleted)

# Vulnerable behavior: deleting printable characters keeps spaces (incorrect)
tr -d '[:print:]' < test.txt
# Expected output (correct): "" (everything deleted)
# Actual output (vulnerable): " " (spaces remain)

Automated Exploitation: An attacker could embed this in a cron job or CI/CD pipeline to corrupt data over time.

Blue Team

Detection:

• Monitor for unusual usage of tr with [:graph:] or [:print:] in scripts or command lines.
• Look for unexpected data loss or corruption in files processed by tr.
• Use file integrity monitoring to detect changes to critical files.

Hunting:

• Search for scripts that use tr -d '[:graph:]' or tr -d '[:print:]' and verify they are not causing data loss.
• Check for anomalies in log files or data pipelines that may indicate space deletion.

Mitigation:

• Update uutils coreutils to the patched version.
• If patching is not immediately possible, avoid using [:graph:] and [:print:] classes in tr. Use explicit character ranges or alternative tools like sed or awk.

Indicators of Compromise (IOCs)

• Command Line: tr -d '[:graph:]' or tr -d '[:print:]' executed on files.
• File Changes: Files that have had spaces unexpectedly removed (e.g., concatenated words, missing whitespace in structured data).
• Log Entries: Scripts or cron jobs that use tr with these classes and produce unexpected output.
• Process Anomalies: tr processes running with arguments containing [:graph:] or [:print:].

Detection Engineering

YARA Rule

rule CVE_2026_35379_tr_character_class_error {
    meta:
        description = "Detects usage of tr with [:graph:] or [:print:] classes that may indicate exploitation of CVE-2026-35379"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35379"
        severity = "low"
    strings:
        $graph = /tr\s+.*\[:graph:\]/ nocase
        $print = /tr\s+.*\[:print:\]/ nocase
    condition:
        any of them
}

Sigma Rule

title: Suspicious tr Usage with Character Classes
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of tr with [:graph:] or [:print:] classes, which may indicate exploitation of CVE-2026-35379
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35379
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/tr'
        CommandLine|contains|all:
            - '[:graph:]'
            - '[:print:]'
    condition: selection
falsepositives:
    - Legitimate use of tr with these classes in scripts that are aware of the bug
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-35379 - tr Character Class Error"; content:"tr"; content:"[:graph:]"; content:"[:print:]"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update uutils coreutils to the latest patched version. Check the official repository for the fix.
2. Audit scripts that use tr with [:graph:] or [:print:] and replace them with correct implementations or alternative tools.
3. Temporarily workaround by using explicit character ranges:
   • Instead of [:graph:], use [!-~] (printable non-space ASCII).
   • Instead of [:print:], use [ -~] (printable including space).

Long-term:

• Implement input validation and output verification in data pipelines.
• Use static analysis tools to detect incorrect character class usage.
• Monitor for CVEs related to uutils coreutils and apply patches promptly.

Patch Details:

• The patch is available in the uutils/coreutils repository. Apply the latest commit that fixes the character class definitions for [:graph:] and [:print:].

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 29C6895DFB65E2908B9D8081] */}