CVE-2026-35347: uutils coreutils comm Silent Data Loss or Denial of Service via Improper Input Validation
The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The arefilesidentical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_commto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
What kinds of comm usage are exposed?
Use of comm with non-regular input paths is exposed, including FIFOs, pipes, and infinite streams such as /dev/zero. The supplied data does not indicate that regular-file-only use is affected.
What access would an attacker need to trigger this issue?
The CVSS vector indicates local access and low privileges are required, with no user interaction required. An attacker would need to cause comm to process a non-regular input path.
What should be done if updating is not immediately possible?
Do not pass FIFOs, pipes, or device-backed/infinite streams to comm. Restrict comm inputs to regular files until the deployment can be updated.
How can teams identify potentially affected workflows?
Review scripts, automation, and wrappers that invoke comm, particularly where input paths may be supplied by pipes, FIFOs, or device files. Calls that accept unvalidated path types warrant priority review.