GHSA-x2wv-9p67-mh9w CVE-2026-35350
uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails
- Severity
- 6.6 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.12%
- Chance of exploitation in the next 30 days. Higher than 2.21% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-281 Improper Preservation of Permissions
- Fix
- None yet
- No fixed version published
Description
The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| coreutils | <= 0.8.0 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 6.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Weakness
CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-m2pg-c7m6-77pj uutils coreutils has an Improper Input Validation Issue in its cut Utility | Medium | Also affects coreutils |
| GHSA-fhr3-xh3q-69w6 uutils coreutils has an Incorrect Provision of Specified Functionality Issue | Low | Also affects coreutils |
| GHSA-5pv5-xh52-hvrp uutils coreutils has an Incorrect Short Circuit Evaluation Issue | Low | Also affects coreutils |
| GHSA-5v4g-vw9x-h534 uutils coreutils has an Improper Input Validation Issue in its env Utility | Low | Also affects coreutils |
| GHSA-6g8r-74qp-6859 uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition | Medium | Also affects coreutils |
| GHSA-vx9m-xjwf-8cqm uutils coreutils has an Improper Handling of Unicode Encoding Issue | Low | Also affects coreutils |
| GHSA-4wrp-79m8-9m9p uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition | Medium | Also affects coreutils |
| GHSA-wq63-vh5h-pr5p uutils coreutils has a UNIX Symbolic Link (Symlink) Following issue | Medium | Also affects coreutils |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor