Executive brief
A vulnerability exists in the 'install' utility of the Rust-based uutils coreutils, which is a modern reimplementation of standard Unix command-line tools. A local attacker can exploit a timing issue during file installation to redirect file writes to unintended locations. This could allow an attacker to overwrite sensitive system files, potentially leading to a full system compromise or service disruption.
Technical details
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the 'install' utility of uutils coreutils before version 0.6.0. The vulnerability occurs because the implementation unlinks an existing destination file and subsequently recreates it using a path-based operation without the O_EXCL flag. A local attacker can exploit the race window between the unlink and the creation steps to replace the target path with a symbolic link. This allows the attacker to redirect privileged writes to arbitrary files on the system. The issue is fixed in version 0.6.0 by using atomic exclusive creation (O_EXCL) to ensure the file is created only if it does not already exist, preventing symlink following.
Affected products
- uutils coreutils (Rust) < 0.6.0
Timeline
- 2026-01-05: other: Pull request to fix the issue submitted
- 2026-01-17: patched: Fix merged into main branch
- 2026-02-02: advisory: Release 0.6.0 published
- 2026-04-22: disclosed: CVE-2026-35355 published
- 2026-07-06: other: Duplicate GHSA advisory withdrawn