UBUNTU-CVE-2026-35350: Medium severity ubuntu/rust-coreutils vulnerability
The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu2~26.04.1
Event History
Frequently Asked Questions
Does exploitation require local access?
Yes. The vulnerability has a local attack vector and requires low privileges; no user interaction is required.
What conditions are needed for the unsafe file state to occur?
A copy must be performed with cp -p, the source must have setuid or setgid mode bits, and the ownership-preservation chown operation must fail. The utility can then apply the privileged source mode bits to the user-owned destination copy.
Which systems should be prioritized for review?
Prioritize Ubuntu systems using the rust-coreutils implementation where local users can run cp -p and copy files with privileged mode bits into locations they own. These workflows can create user-owned executables retaining unexpected setuid or setgid bits.