CVE-2026-35352: 
Rust vulnerability analysis and mitigation

CVE-2026-35352 is a Time-of-Check to Time-of-Use (TOCTOU) race condition in the mkfifo utility of uutils coreutils (the Rust reimplementation of GNU coreutils). The vulnerability was reported on January 3, 2026, and publicly disclosed on April 22, 2026. It affects uutils coreutils versions ≤ 0.8.0 for Rust (cargo package). The CVSS v3.1 base score is 7.0 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-367 (Time-of-check Time-of-use Race Condition). The mkfifo utility creates a FIFO using mknodat and then unconditionally applies permissions via a path-based chmod call (std::fs::set_permissions). Between these two operations, a local attacker with write access to the parent directory can delete the newly created FIFO and replace it with a symbolic link pointing to an arbitrary file (e.g., /etc/shadow), causing the subsequent chmod call to modify the target of the symlink instead. A strace of the vulnerable code shows the sequence: mknodat(AT_FDCWD, "/tmp/fifo", S_IFIFO|0666) = 0 followed by chmod("/tmp/fifo", 0700) = 0, with the race window between these two syscalls being exploitable. Notably, the attack is constrained by the sticky bit in world-writable directories like /tmp, meaning the victim must run mkfifo in a directory where the attacker has write access, such as the attacker's home directory (GitHub Issue, oss-security).

If mkfifo is executed with elevated privileges (e.g., as root or via a setuid wrapper) in a directory writable by the attacker, successful exploitation allows the attacker to redirect a chmod call to an arbitrary file, potentially altering permissions on sensitive system files such as /etc/shadow or /etc/passwd. This can lead to high confidentiality, integrity, and availability impact, including privilege escalation to root. The attack is local and requires the attacker to already have write access to the target directory, limiting the blast radius compared to remote vulnerabilities (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept (PoC) demonstrating the race condition is publicly available in the uutils coreutils GitHub issue tracker, using two racing terminal loops — one replacing the FIFO with a symlink and one repeatedly invoking mkfifo with elevated privileges (GitHub Issue). There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.01% (0th percentile), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Identify a target scenario: Confirm that mkfifo from uutils coreutils (≤ 0.8.0) is being run with elevated privileges (e.g., root or setuid) in a directory where the attacker has write access (e.g., /home/attacker/).
2. Set up the attacker racing loop (Terminal 1): Continuously delete the FIFO and replace it with a symlink to a sensitive target file:

   while true; do rm -f /home/attacker/fifo; ln -s /etc/shadow /home/attacker/fifo; done

3. Trigger the victim operation (Terminal 2): Repeatedly invoke mkfifo with a specific permission mode in the attacker-writable directory:

   while true; do rm -f /home/attacker/fifo; mkfifo -m 0666 /home/attacker/fifo; done

4. Win the race: Between the mknodat (FIFO creation) and chmod (permission setting) syscalls, the attacker's loop replaces the FIFO with the symlink, causing chmod to follow the symlink and modify /etc/shadow.
5. Verify impact: Check whether the permissions on /etc/shadow have been changed (e.g., made world-readable), enabling the attacker to read password hashes and escalate privileges (GitHub Issue).

• File System: Unexpected permission changes on sensitive files such as /etc/shadow, /etc/passwd, or /etc/sudoers; presence of symbolic links in directories where mkfifo was recently invoked.
• Logs: Audit log entries (auditd) showing chmod or fchmodat syscalls targeting sensitive files from a process running as root or with elevated privileges; repeated rapid creation and deletion of FIFO files in a single directory.
• Process: Unusual process behavior where mkfifo (uutils coreutils) is invoked in a loop or in a directory owned by a non-root user; strace output showing chmod following a symlink to a sensitive path.

As of the GitHub Advisory publication (April 22, 2026), no patched version of uutils coreutils has been released — the advisory lists all versions ≤ 0.8.0 as affected with "None" listed for patched versions (GitHub Advisory). Recommended mitigations include: (1) restricting write access to directories where mkfifo is executed with elevated privileges; (2) avoiding running mkfifo from uutils coreutils with setuid or root privileges until a fix is available; (3) applying the principle of least privilege for any setuid binaries; and (4) monitoring the uutils coreutils GitHub repository and Red Hat Bugzilla for patch availability (Red Hat Bugzilla, GitHub Issue).

Discussion on the oss-security mailing list raised questions about the severity of the vulnerability. Researcher Jakub Wilk noted that the symlink-swap attack does not work in /tmp due to the sticky bit, and that exploitation requires the victim to run mkfifo in a directory writable by the attacker (e.g., mkfifo /home/mallory/fifo), calling it "questionable if this is a vulnerability at all." Another respondent countered that it is a vulnerability, albeit of low severity. The CVE was assigned by Canonical, and Red Hat has tracked it as high severity in their Bugzilla (oss-security, oss-security, Red Hat Bugzilla).