Common Linux Tools Have a Sneaky Permission Flaw

Security flaws in a popular Rust rewrite of core Linux tools could allow attackers to secretly change file permissions on your system.

Ubuntu Security Notices has issued an alert detailing two vulnerabilities found within `uutils coreutils`, a modern, Rust-based implementation of the essential command-line tools found on most Unix-like operating systems. These flaws, if exploited, could allow a local attacker to cause unexpected and potentially dangerous behavior on an affected system. The first vulnerability allows for the unauthorized modification of file permissions, while the second can cause critical errors to go completely unnoticed by system administrators and automated scripts. The discovery affects anyone using this alternative toolset, which has been gaining popularity for its promise of enhanced safety and performance. While not the default on mainstream Linux distributions like Ubuntu, `uutils coreutils` is increasingly found in containerized environments, custom operating system builds, and other scenarios where developers are opting for more modern foundational software. The alert serves as a critical reminder that even software designed with security as a primary goal is not immune to flaws in its fundamental logic.

The more severe of the two issues, identified as CVE-2026-35341, is a logic flaw in the `mkfifo` utility, a tool used to create special files called named pipes for inter-process communication. According to the advisory, the `uutils` version of `mkfifo` behaves incorrectly when it is instructed to create a pipe at a location where a file already exists. Instead of halting with an error as expected, the program continues its execution and applies a set of default permissions to the pre-existing file. This creates a classic race condition scenario. A malicious user with local access could create a placeholder file and wait for a higher-privilege process, such as a system startup script, to run `mkfifo` on that same path. The script would then inadvertently change the permissions of the attacker's file, potentially granting them elevated access or weakening the security of a critical system component. The second vulnerability impacts the `dd` command, a powerful utility for copying and converting data. The flaw causes `dd` to suppress, or hide, errors that occur during file truncation operations. This means that if `dd` fails to correctly shorten a file, it will not report the failure, leading to a silent corruption of data. This could have serious consequences for backup scripts, disk imaging processes, and other operations that rely on `dd` to function correctly and report its status accurately.

These vulnerabilities are particularly noteworthy because of the context surrounding `uutils coreutils`. The entire project is part of a broader, industry-wide movement to rewrite critical, low-level infrastructure from legacy languages like C and C++ into memory-safe languages, with Rust being a prominent choice. The primary motivation for this massive effort is to eliminate entire categories of dangerous security bugs, such as buffer overflows and use-after-free errors, which have plagued systems for decades. Proponents of this shift argue that a memory-safe foundation makes software inherently more secure. This incident, however, provides a dose of reality. While Rust’s compiler can prevent memory-related errors, it cannot prevent logical mistakes in the code's design. The `mkfifo` bug is a classic example of a Time-of-Check to Time-of-Use (TOCTOU) flaw, a type of race condition that has existed for as long as multitasking operating systems. The `dd` bug is a simple case of improper error handling. This proves that a secure language is not a panacea for security; it is a powerful tool, but it does not replace the need for careful design, rigorous code reviews, and comprehensive security testing that considers all potential classes of vulnerabilities, not just memory corruption.

For CTOs, developers, and security teams, the immediate takeaway is the need for diligent software supply chain management. The first step is to identify whether any systems, particularly container images or custom-built environments, are running `uutils coreutils` instead of the standard GNU coreutils. If the package is present, it must be updated to a patched version as soon as possible to mitigate the risk. System administrators should also consider auditing the permissions of critical files to ensure no unexpected changes have occurred. Looking beyond the immediate patch, this event serves as a valuable lesson in the ongoing evolution of system security. As the industry continues to adopt new, safer programming languages for foundational components, security focus must evolve as well. Teams cannot become complacent and assume that a "Rust-rewrite" is inherently secure. Instead, they must adapt their threat models to focus more on logic flaws, race conditions, and insecure API usage patterns. The future of infrastructure security will depend not just on choosing the right language, but on maintaining a culture of deep, holistic security analysis for every component in the stack, no matter how modern or "safe" it purports to be.

Teams adopting the Rust-based uutils coreutils for its perceived safety benefits now face classic logic bugs. This highlights that memory safety doesn't eliminate all vulnerability classes, and even fundamental utilities require rigorous security auditing, challenging assumptions about 'safe' languages.

Companies using systems with uutils coreutils face a heightened risk of local privilege escalation or data exposure. This could lead to compliance violations or internal data breaches if an attacker with low-level access exploits these flaws. Auditing and patching affected systems are now necessary operational costs.