CVE-2026-35358: 
Rust vulnerability analysis and mitigation

CVE-2026-35358 is a denial-of-service vulnerability in the cp utility of uutils coreutils (the Rust reimplementation of GNU coreutils) affecting all versions before 0.7.0. When performing recursive copies with the -R flag, the utility incorrectly treats character and block device nodes as stream sources rather than preserving them via mknod, destroying device semantics (e.g., /dev/null becomes a regular file). This can lead to disk exhaustion or process hangs when reading from unbounded device nodes. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, or 4.4 (Moderate) per the GitHub Advisory Database (GitHub Advisory, Feedly).

The root cause is classified as CWE-706 (Use of Incorrectly-Resolved Name or Reference): the cp implementation's is_stream() function returns true for character and block device nodes, causing the utility to read bytes from the device into a regular file at the destination rather than calling mknod to recreate the device node with its major/minor numbers. GNU cp preserves device nodes by default during recursive copies, reserving stream-reading behavior for the explicit --copy-contents flag. The fix, merged in PR #11163 by contributor victor-prokhorov on March 4, 2026, adds proper special-file handling to the cp implementation (GitHub PR, GitHub Advisory).

Exploitation results in availability impact: a local attacker can cause disk exhaustion by triggering reads from unbounded device nodes (e.g., /dev/urandom) into regular files, or cause process hangs when reading from blocking device nodes. There is no confidentiality impact, and integrity impact is limited to the corruption of device node semantics in the destination filesystem tree. Environments particularly at risk include those using uutils cp to construct chroot environments, initramfs staging areas, or container filesystems where device nodes must retain their type and major/minor numbers (GitHub Issue, GitHub Advisory).

A proof-of-concept is publicly available in the original bug report, consisting of simple bash commands using mknod and cp -R that reproduce the issue without network access (GitHub Issue). Exploitation requires local access and low privileges (the ability to run cp and create device nodes, typically requiring sudo mknod). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.014% (3rd percentile), indicating a very low probability of near-term exploitation (GitHub Advisory).

1. Prerequisite: Obtain local access to a system running uutils coreutils (Rust) version prior to 0.7.0, with sufficient privileges to create device nodes (typically requires sudo or CAP_MKNOD).
2. Create a source directory with a device node: Run src="$(mktemp -d)" && sudo mknod "${src}/null" c 1 3 to create a character device node (major 1, minor 3, equivalent to /dev/null) in a temporary directory.
3. Trigger the vulnerable recursive copy: Run dst="$(mktemp -d)" && cp -R "${src}" "${dst}" using the uutils cp binary.
4. Observe incorrect behavior: Run ls -l "${src}/null" "${dst}/null" — the source shows a character device (crw-...), while the destination shows a regular file, confirming device semantics were destroyed.
5. Escalate to DoS: Replace the device node with an unbounded source such as /dev/urandom or /dev/zero (sudo mknod "${src}/urandom" c 1 9) and repeat the recursive copy to exhaust disk space or hang the process (GitHub Issue).

• Process: Unexpected cp processes with -R or -a flags running for extended periods, consuming significant CPU or I/O.
• File System: Regular files appearing at paths where device nodes are expected (e.g., destination directories containing zero-byte or growing regular files named null, zero, urandom, or random instead of character/block device entries); rapidly growing files in temporary or staging directories.
• Logs: System logs (/var/log/syslog, journald) showing disk-full errors or I/O errors originating from cp processes; dmesg entries related to filesystem capacity exhaustion.
• Resource Monitoring: Sudden disk space consumption on volumes used as copy destinations; df showing unexpected filesystem fill rates correlated with cp -R invocations (GitHub Issue).

Upgrade uutils coreutils to version 0.7.0 or later, which includes the fix from PR #11163 that properly handles special files during recursive copies using mknod (GitHub Release). As an interim workaround, restrict use of the uutils cp -R (or -a) command on directory trees containing device nodes, or implement filesystem-level restrictions (e.g., mount options, SELinux/AppArmor policies) to prevent unprivileged creation of device nodes in source directories. Organizations using uutils coreutils as a drop-in replacement for GNU coreutils in container build pipelines or initramfs tooling should prioritize upgrading (GitHub Advisory).

The vulnerability was reported by Canonical (assigner) and discussed in the Ubuntu community, with a post on the Ubuntu Discourse forum titled "An update on Rust coreutils" referencing the issue (Ubuntu Discourse). The fix was contributed by a community member (victor-prokhorov) and merged promptly by the project maintainer (sylvestre), with the patch shipping in the 0.7.0 release on March 8, 2026. The issue was also disclosed on the oss-security mailing list (oss-sec). Community reaction was generally constructive, with the bug labeled "good first issue" and resolved through normal open-source contribution processes.