Junglewise Threat Intelligence

CVE-2026-35353: uutils coreutils race condition in mkdir -m permissions assignment

CVE-2026-35353 · Severity: low · CVSS 3.3 · Published 2026-07-06

Vendors: crates.io, Uutils.

Executive brief

The mkdir utility in uutils coreutils, a Rust-based implementation of standard system tools, contains a flaw when creating new folders with specific security settings. When a user creates a private folder, the tool briefly creates it with default public permissions before restricting them. In shared computing environments, this creates a split-second window where an unauthorized user could access sensitive data intended to be private.

Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the uutils coreutils 'mkdir' implementation when the '-m' (mode) flag is used. The utility originally performed two separate operations: a 'mkdir' syscall using default umask-derived permissions (often 0755), followed by a 'chmod' syscall to apply the user-requested mode. This sequence leaves a race window where the directory is accessible to other local users with broader permissions than intended. The vulnerability was fixed in version 0.6.0 by adopting the GNU coreutils approach: temporarily setting the process umask to 0 to allow the 'mkdir' syscall to create the directory atomically with the final requested permissions.

Affected products

  • uutils coreutils (uu_mkdir) < 0.6.0

Timeline

  • 2026-01-03: other: Fix proposed in pull request #10036
  • 2026-01-18: patched: Fix merged into main branch
  • 2026-05-30: advisory: GitHub Advisory published
  • 2026-07-06: disclosed: Advisory reviewed and updated

References