CVE-2026-35371: uutils coreutils id Misleading Identity Reporting in Pretty Print Mode
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_idto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35371?
CVE-2026-35371 is classified as a moderate severity vulnerability.
How do I fix CVE-2026-35371?
You can fix CVE-2026-35371 by updating to the latest version of uutils coreutils where the issue has been addressed.
What systems are impacted by CVE-2026-35371?
CVE-2026-35371 affects the uutils coreutils id utility specifically in its pretty print mode.
What is the nature of the vulnerability CVE-2026-35371?
CVE-2026-35371 involves misleading identity reporting due to incorrect usage of effective GID instead of effective UID.
Is there a workaround for CVE-2026-35371?
Currently, the best approach is to avoid using the pretty print mode until the vulnerability is resolved in an update.