UBUNTU-CVE-2026-35367: Low severity ubuntu/rust-coreutils vulnerability
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using ubuntu/rust-coreutils in multi-user environments are exposed when nohup writes output to its default nohup.out file. Other local users may be able to read captured command output if the file is created with typical umask-derived world-readable permissions.
What does an attacker need to exploit it?
An attacker needs local access to the same system and permission to read the directory containing the generated nohup.out file. They do not need to modify the command or interact with the user running nohup.
Are default nohup invocations affected?
Yes. The issue concerns the default output file created by nohup when it uses nohup.out; that file is created without explicitly restricted permissions and inherits permissions from the user's umask.
What can be done if an update is not immediately available?
Avoid relying on the default nohup.out file for sensitive output. Redirect stdout and stderr to a file created with owner-only permissions, and review existing nohup.out files for unintended read access.
How can I determine whether sensitive output may already be exposed?
Locate nohup.out files created by affected installations and inspect their permissions and contents. A file with permissions such as 0644 may be readable by other local users and should be treated as potentially exposed if it contains sensitive output.