CVE-2026-35350: uutils coreutils cp Unexpected Privileged Executable Creation with -p
The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35350?
The severity of CVE-2026-35350 is categorized as high due to its potential to create unexpected privileged executables.
How do I fix CVE-2026-35350?
To fix CVE-2026-35350, update to a patched version of uutils coreutils where the setuid and setgid handling is properly implemented.
What are the potential impacts of CVE-2026-35350?
CVE-2026-35350 can lead to security risks such as unauthorized privilege escalation through the creation of setuid or setgid executables.
Which versions of uutils coreutils are affected by CVE-2026-35350?
CVE-2026-35350 affects all versions of uutils coreutils prior to the fix in the updated releases.
Is there a workaround for CVE-2026-35350?
A potential workaround for CVE-2026-35350 is to avoid using the -p flag with the cp command until an update is applied.