UBUNTU-CVE-2026-35345: Medium severity ubuntu/rust-coreutils vulnerability
A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when a privileged user monitors a log directory with uutils tail using --follow=name and a local attacker can write to that directory. The impact is disclosure of files readable by the privileged tail process.
What does an attacker need to exploit it?
The attacker needs local access with permission to replace a monitored log file in the relevant directory. They can replace that file with a symbolic link to a sensitive file, causing the privileged tail process to output the target's contents.
Is a default tail invocation affected?
The issue specifically involves the --follow=name option. The provided information does not establish that other tail modes or default invocations are affected.
What can be done if patching is not immediately possible?
Avoid using uutils tail with --follow=name as a privileged user on directories writable by less-privileged users. Restrict write access to directories containing files monitored by privileged processes.
How can I identify potentially affected usage?
Review privileged scripts, services, and interactive workflows for uutils tail commands using --follow=name. Prioritize cases where the monitored path is in a directory writable by local unprivileged users.