UBUNTU-CVE-2026-35376: Medium severity ubuntu/rust-coreutils vulnerability
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves recursive targets using a fresh path lookup (via ftsaccpath) rather than binding the traversal and label application to the specific directory state encountered during traversal. Because these operations are not anchored to file descriptors, a local attacker with write access to a directory tree can exploit timing-sensitive rename or symbolic link races to redirect a privileged recursive relabeling operation to unintended files or directories. This vulnerability breaks the hardening expectations for SELinux administration workflows and can lead to the unauthorized modification of security labels on sensitive system objects.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu1
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker who has write access to a directory tree involved in the operation can attempt exploitation. The attacker must be able to race directory renames or symbolic-link changes during processing.
What conditions are required for impact?
The vulnerable utility must be used for a privileged recursive relabeling operation. The impact relies on timing-sensitive path changes that redirect the operation toward unintended files or directories.