UBUNTU-CVE-2026-35359: Medium severity ubuntu/rust-coreutils vulnerability
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the ONOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when a privileged cp process copies attacker-influenced source paths and the attacker has concurrent write access to replace a source file during the copy operation. The impact is disclosure of sensitive file contents into an attacker-controlled destination.
What does an attacker need to exploit it?
The attacker needs local access, low-level privileges, and concurrent write access to the source path or its relevant filesystem location. They must win the timing window by replacing a regular file with a symbolic link after cp checks it but before it opens the file.
Does this require user interaction or affect integrity or availability?
No user interaction is required. The supplied severity vector identifies confidentiality impact as high, with no integrity or availability impact.