CVE-2026-35350

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35350", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-04-02T12:58:56.087Z", "datePublished": "2026-04-22T16:08:02.526Z", "dateUpdated": "2026-04-22T17:58:14.456Z"}, "containers": {"cna": {"title": "uutils coreutils cp Unexpected Privileged Executable Creation with -p", "affected": [{"vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "collectionURL": "https://github.com/uutils", "packageName": "coreutils", "repo": "https://github.com/uutils/coreutils", "defaultStatus": "affected"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-281", "description": "CWE-281: Improper Preservation of Permissions", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122: Privilege Abuse"}]}], "descriptions": [{"lang": "en", "value": "The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved."}], "references": [{"url": "https://github.com/uutils/coreutils/issues/9750", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 6.6, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"}}], "credits": [{"lang": "en", "value": "Zellic", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-22T16:08:02.526Z"}}, "adp": [{"references": [{"url": "https://github.com/uutils/coreutils/issues/9750", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T17:56:50.879133Z", "id": "CVE-2026-35350", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T17:58:14.456Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35350", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T17:56:50.879133Z"}}}], "references": [{"url": "https://github.com/uutils/coreutils/issues/9750", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T17:56:10.952Z"}}], "cna": {"title": "uutils coreutils cp Unexpected Privileged Executable Creation with -p", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Zellic"}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122: Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}], "references": [{"url": "https://github.com/uutils/coreutils/issues/9750", "tags": ["issue-tracking"]}], "descriptions": [{"lang": "en", "value": "The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-281", "description": "CWE-281: Improper Preservation of Permissions"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-22T16:08:02.526Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35350", "state": "PUBLISHED", "dateUpdated": "2026-04-22T17:58:14.456Z", "dateReserved": "2026-04-02T12:58:56.087Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-04-22T16:08:02.526Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/uutils", "defaultStatus": "affected", "packageName": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "product": "coreutils", "repo": "https://github.com/uutils/coreutils", "vendor": "Uutils"}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved."}, {"lang": "es", "value": "La utilidad cp en uutils coreutils no maneja correctamente los bits setuid y setgid cuando falla la preservaci\u00f3n de la propiedad. Al copiar con la opci\u00f3n -p (preservar), la utilidad aplica los bits de modo de origen incluso si la operaci\u00f3n chown no tiene \u00e9xito. Esto puede resultar en una copia propiedad del usuario que retiene los bits privilegiados originales, creando ejecutables privilegiados inesperados que violan las pol\u00edticas de seguridad locales. Esto difiere de GNU cp, que borra estos bits cuando no se puede preservar la propiedad."}], "id": "CVE-2026-35350", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.7, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35350", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T17:56:50.879133Z", "version": "2.0.3"}}]}, "published": "2026-04-22T17:16:37.327", "references": [{"source": "security@ubuntu.com", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/uutils/coreutils/issues/9750"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/uutils/coreutils/issues/9750"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-281"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux", "unix", "macos"], "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "coreutils", "source": "cna", "vendor": "Uutils"}, "product": "coreutils", "vendor": "uutils"}], "analysis": {"en": {"generated_at": "2026-04-28T08:01:41.959808+00:00", "value": {"mitigation_remediation": ["Upgrade uutils coreutils to a version that fixes the setuid handling bug.", "Avoid using the -p flag when copying files with setuid or setgid bits; instead, copy normally and then strip privileged bits with chmod u-s.", "Configure the system or deployment to automatically clear setuid/setgid bits on files placed in user writable locations, e.g., by using a file-system hook or by enforcing a mount option that removes these bits."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation via Privileged Executable Creation"}, "threat_synthesis": {"affected_systems": "The affected product is the uutils coreutils package. No specific version information is provided in the CVE data, so any installation of the current uutils coreutils release that contains the described implementation flaw is potentially vulnerable.", "description_and_impact": "The cp utility in uutils coreutils does not correctly handle setuid and setgid bits when ownership preservation fails. When a user runs cp with the preserve flag (-p) and the underlying chown operation cannot change the file owner, the utility still applies the original mode bits to the target file. This results in the resulting file inheriting privileged bits, effectively creating a privileged executable owned by the user. The vulnerability allows local attackers to fabricate executables that run with elevated privileges, violating local security policies. The weakness is identified as CWE-281. Based on the description, the likely attack scenario involves a user copying a setuid setgid file to a location where they have write permissions, relying on the preserve flag, and thereby gaining the ability to execute code as a higher-privileged user.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.6, signifying moderate severity. The EPSS score of < 1% suggests a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. An attacker would need local access: the ability to read a source file that has setuid or setgid bits and the capability to write to a target directory where the copy will be placed. If the chown operation fails because the attacker does not have root permissions, the preserved setuid/setgid bits remain on the created file, giving the user the ability to execute code with elevated privileges. In typical desktop or server environments where unprivileged users have write access to directories that may receive copies of setuid files, the exploit conditions are achievable."}}}}, "created": "2026-04-27T19:54:35.068332+00:00", "updated": "2026-04-28T08:15:23.645853+00:00", "vendors": ["uutils", "uutils$PRODUCT$coreutils"]}