Executive brief
The printenv utility in uutils coreutils, a Rust-based alternative to standard system tools, fails to display environment variables that contain certain non-standard characters (invalid UTF-8). This behavior allows a local attacker to hide malicious environment variables, such as those used to force the loading of unauthorized software libraries (LD_PRELOAD), from administrators and security monitoring tools. While the system remains functional, security audits may fail to detect active threats or unauthorized configurations.
Technical details
The printenv utility in uutils coreutils (prior to version 0.6.0) incorrectly handles environment variables containing invalid UTF-8 byte sequences. While POSIX allows environment strings to consist of arbitrary bytes, the uutils implementation utilized Rust's 'env::var()' and 'env::vars()' functions, which silently discard entries that are not valid UTF-8. A local attacker can exploit this by setting environment variables (e.g., LD_PRELOAD) with trailing or embedded invalid bytes to hide them from administrators using printenv for inspection. This facilitates stealthy library injection or environment-based attacks. The issue was resolved by switching to the '_os()' variants of the environment functions to handle raw byte sequences.
Affected products
- uutils coreutils < 0.6.0
Timeline
- 2025-12-18: disclosed: Issue reported on GitHub repository
- 2025-12-22: patched: Fix merged into main branch
- 2026-02-02: advisory: Release 0.6.0 published with the fix
- 2026-04-22: advisory: GitHub Advisory and CVE-2026-35366 published
- 2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-p7h3-7q52-72w8