Executive brief
The 'chmod' utility in uutils coreutils (a Rust-based alternative to standard GNU tools) contains a flaw in how it reports errors when modifying multiple files at once. When used in recursive mode, the tool may report a successful exit code even if it failed to change permissions on some files, provided the very last file processed was successful. This can lead system administrators or automated scripts to believe security permissions were correctly applied when sensitive files actually remain unprotected.
Technical details
A vulnerability exists in the recursive mode (-R) of the chmod utility within uutils coreutils due to improper return value handling (CWE-253). When processing multiple files, the utility determines the final process exit code based solely on the success or failure of the last file in the sequence. An attacker or a system error could cause earlier file permission changes to fail (e.g., 'Operation not permitted'), but if the final file is processed successfully, the utility returns 0. This can cause shell scripts and automation tools to proceed as if all permissions were updated correctly, leading to silent failures in security enforcement. The issue is fixed in version 0.6.0.
Affected products
- uutils coreutils (Rust) < 0.6.0
Timeline
- 2025-12-23: other: Pull request submitted to fix the issue
- 2026-01-01: patched: Fix merged into main branch
- 2026-02-02: other: Version 0.6.0 released
- 2026-04-22: advisory: Initial GHSA and CVE-2026-35339 published
- 2026-07-06: other: Advisory GHSA-vp6q-mv9j-j428 withdrawn as duplicate of GHSA-4x34-chg5-mwjj