CVE-2026-35371: 
Rust vulnerability analysis and mitigation

CVE-2026-35371 is a UI misrepresentation vulnerability (CWE-451) in the id utility of uutils coreutils, a Rust-based reimplementation of GNU coreutils. When the real UID and effective UID differ, the id command's "pretty print" mode incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user, producing misleading diagnostic output. The vulnerability affects uutils coreutils versions ≤ 0.8.0 for Rust (cargo). It was disclosed on April 22, 2026, with a CVSS v3.1 base score of 3.3 (Low) (Github Advisory, Red Hat Bugzilla).

The root cause is a logic error (CWE-451: User Interface Misrepresentation of Critical Information) in the id utility's pretty-print implementation within uutils coreutils. Specifically, the code at src/uu/id/src/id.rs uses the effective GID rather than the effective UID when resolving the username for the effective user, resulting in incorrect output. Additionally, the utility panics (crashes) when given a malformed or non-existent group ID during pretty-print mode (e.g., via sudo setpriv --regid 1337 --clear-groups id -p). Exploitation requires local access and low privileges — an attacker or unprivileged user can invoke setpriv to set differing real and effective UIDs/GIDs and trigger the incorrect output (Github Issue, Github Advisory).

The primary impact is integrity-related: the id utility produces misleading output that misrepresents the effective user identity when real and effective UIDs differ. This can cause system administrators or automated scripts relying on id -p output to make incorrect access control or file permission decisions based on false identity information. There is no confidentiality or availability impact beyond the panic/crash in the pretty-print path when a non-existent group ID is used (Github Advisory, Github Issue).

A proof-of-concept is publicly available in the uutils coreutils GitHub issue tracker, demonstrating reproduction using standard Linux tools (setpriv, id). There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.01% (3rd percentile), reflecting very low probability of exploitation in the near term (Github Issue, Github Advisory).

1. Setup: On a Linux system running uutils coreutils ≤ 0.8.0, create two test users: useradd -u 2000 u2000 -M and useradd -u 3000 u3000 -M.
2. Trigger incorrect output (compact mode): Run sudo setpriv --reuid 3000 --egid 2000 --clear-groups target/release/id and observe that the groups field shows incorrect information compared to the system id binary.
3. Trigger incorrect output (pretty-print mode): Run sudo setpriv --euid 3000 --egid 2000 --clear-groups target/release/id -p and observe that the euid field displays root instead of u3000, and groups shows u2000 (the effective GID's name) instead of the correct effective user.
4. Trigger panic/crash: Run sudo setpriv --regid 1337 --clear-groups target/release/id -p with a non-existent GID (1337) to cause a panic in the pretty-print path, crashing the utility.
5. Exploit impact: Any automated script or administrator relying on the id -p output to make access control decisions will receive false identity information, potentially granting or denying access incorrectly (Github Issue).

Update uutils coreutils to a version beyond 0.8.0 once a patched release is available; the GitHub Advisory currently lists no patched version, so users should monitor the upstream repository for fixes. As a workaround, avoid relying on id -p (pretty-print mode) output from uutils coreutils in automated scripts or access control logic when real and effective UIDs may differ — use the system GNU id binary instead. Review any access control decisions or file permission configurations that may have been made based on id output in environments where setuid/setgid scenarios are common (Github Advisory, Red Hat Bugzilla).

The vulnerability was reported to the uutils project by Canonical (as indicated by the reported-canonical label on the GitHub issue) and tracked by Red Hat's Product Security team via Bugzilla. An Ubuntu community discussion on the transition to Rust coreutils referenced the issue. No significant broader media coverage or notable researcher commentary beyond the upstream issue tracker has been identified (Github Issue, Red Hat Bugzilla).