UBUNTU-CVE-2026-35344: Low severity ubuntu/rust-coreutils vulnerability
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu1
Event History
Frequently Asked Questions
Who is exposed to this issue in practice?
Systems using the uutils coreutils implementation of dd are exposed when scripts or operators truncate regular destination files or directories as part of backup or migration workflows. The impact is most relevant where storage can become full or the destination file system can become read-only.
What conditions are needed for the failure to cause harm?
A truncation operation must fail, such as because the disk is full or the target file system is read-only, and the workflow must rely on dd reporting that failure. Because the error is suppressed, later steps may treat an incompletely updated destination as valid.
Are special files the only affected targets?
No. Suppressing truncation errors was intended to match GNU behavior for special files such as /dev/null, but the described behavior also hides failures involving regular files and directories.
How can administrators detect possible impact?
Review backup and migration jobs that use the uutils dd utility and may have run while destination storage was full or read-only. Validate destination file contents rather than relying only on dd's reported success status, especially where old or garbage data would be harmful.