CVE-2026-35355: 
Rust vulnerability analysis and mitigation

CVE-2026-35355 is a Time-of-Check to Time-of-Use (TOCTOU) race condition in the install utility of uutils coreutils, a Rust-based reimplementation of GNU coreutils. The vulnerability allows a local attacker with low privileges to redirect privileged file writes to overwrite arbitrary system files via a symbolic link attack. It affects all versions of uutils coreutils prior to 0.6.0 (Rust/cargo package). The vulnerability was published on April 22, 2026, and carries a CVSS v3.1 base score of 6.3 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-367 (Time-of-check Time-of-use Race Condition). The install utility's implementation first unlinks an existing destination file and then recreates it using a path-based file operation without specifying the O_EXCL flag, creating a race window between the unlink and the subsequent file creation. During this window, a local attacker can replace the destination path with a symbolic link pointing to an arbitrary system file, causing the privileged write operation to follow the symlink and overwrite the target. The fix, merged in PR #10067, uses Rust's create_new() method (which internally uses O_EXCL) to atomically create the file, failing if anything — including a symlink — already exists at the path (Github PR, Github Advisory).

A local user with low privileges can exploit this race condition to cause privileged write operations to overwrite arbitrary system files, potentially leading to privilege escalation, system compromise, or denial of service. The vulnerability has high integrity and high availability impact, but no confidentiality impact, as the attacker can corrupt or replace critical files (e.g., /etc/passwd, system binaries) but cannot directly read sensitive data through this vector. The attack is local and requires the attacker to win a timing race, which limits but does not eliminate practical exploitability (Github Advisory, Red Hat Bugzilla).

There is no confirmed in-the-wild exploitation or public proof-of-concept exploit code for CVE-2026-35355. The referenced GitHub PR (#10067) contains only the patch and test cases, with no exploit instructions or reproduction steps (Github PR). The EPSS score is approximately 0.012–0.013%, placing it in the 2nd percentile for exploitation likelihood (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported. Exploitation requires local access, low privileges, and the ability to win a timing race, making opportunistic mass exploitation unlikely.

1. Identify target: Confirm the target system is running uutils coreutils (Rust) version prior to 0.6.0 with the install utility available and used in a privileged context (e.g., as part of a build or deployment script running with elevated permissions).
2. Prepare symlink attack: As a low-privileged local user, identify the destination path that the privileged install command will write to (e.g., /tmp/target_file or a known installation path).
3. Monitor for unlink: Use system call tracing tools (e.g., inotifywait, strace, or a busy-loop script) to detect when the install utility unlinks the existing destination file.
4. Race the window: Immediately after the unlink is detected and before the file is recreated, create a symbolic link at the destination path pointing to the target system file to overwrite (e.g., ln -s /etc/passwd /tmp/target_file).
5. Trigger privileged write: The install utility, lacking O_EXCL protection, follows the symlink and writes the installed file's contents to the symlink target, overwriting the arbitrary system file with attacker-controlled content.
6. Achieve objective: Depending on the overwritten file, the attacker may achieve privilege escalation (e.g., modifying /etc/passwd or /etc/sudoers) or denial of service by corrupting critical system files (Github PR, Github Advisory).

• File System: Unexpected symbolic links appearing at installation destination paths during or after privileged install operations; unexpected modifications to system files (e.g., /etc/passwd, /etc/sudoers, system binaries) with timestamps coinciding with install utility execution.
• Logs: Audit logs (auditd) showing symlink or rename syscalls at destination paths immediately following unlink events from the install process; unexpected file ownership or permission changes on critical system files.
• Process: Presence of scripts or processes using inotifywait or tight polling loops monitoring directories where privileged install operations occur; unusual child processes spawned by low-privilege users near the time of privileged installations.

The primary remediation is to upgrade uutils coreutils to version 0.6.0 or later, which fixes the vulnerability by using atomic exclusive file creation (O_EXCL) in the install utility (Github Advisory, Release 0.6.0). For systems unable to upgrade immediately, restrict use of the install utility to trusted users only, or disable it if not required in the environment. Additionally, avoid running install with elevated privileges in directories writable by untrusted local users, and consider using filesystem-level controls (e.g., noexec, restricted directory permissions) to limit the attack surface.

The vulnerability generated moderate community discussion, particularly in the context of a broader analysis of security issues in Rust-based software. Blog posts and articles noted that CVE-2026-35355 is one of 44 CVEs found in uutils coreutils, highlighting that Rust's memory safety guarantees do not protect against logic-level vulnerabilities like TOCTOU race conditions (corrode.dev blog, logicity.in blog). Ubuntu also published an update on the status of Rust coreutils in response to these findings (Ubuntu Discourse). The oss-security mailing list also carried a disclosure notice (oss-sec).