CVE-2026-93658: uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
uutils coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0 - Compensating control
On capability-restricted systems, prevent execution of unexpected setuid/setgid binaries (e.g., remove/disable setuid and setgid permissions from uutils coreutils installation destinations where applicable) until ownership-change operations are reliable after upgrading to 0.10.0.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using uutils coreutils versions before 0.10.0 are exposed when privileged users install files with setuid or setgid modes and the intended ownership change can fail. The described attack condition specifically involves capability-restricted systems.
What does an attacker need to exploit it?
An attacker needs a leftover setuid executable whose ownership change failed during installation. They can then execute that file to obtain the elevated privileges associated with its privileged owner.
Are default installations necessarily affected?
The issue requires an installation operation that applies setuid or setgid mode and then encounters a failed ownership change. The provided information does not establish that this occurs in a default configuration.
What should be done if upgrading is not immediately possible?
Avoid installation workflows that create setuid or setgid destinations where ownership changes may fail, particularly on capability-restricted systems. Check for and remove or correct ownership and permission settings on any leftover setuid executables created by privileged installation operations.
How can I determine whether I may already be affected?
Review privileged installation operations for failed ownership changes and inspect resulting destination files for setuid or setgid permissions combined with ownership by the privileged invoker. Focus on installations performed with uutils coreutils versions before 0.10.0.