[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAPmip_zR5WVXiie_NOMPD89NQNtj_Rt=pQFKp9DN=NwRhYg+zw@mail.gmail.com>
Date: Mon, 4 May 2026 06:14:03 -0400
From: cyber security <cs7778503@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: uutils coreutils CVEs
of course, it is a vuln, of low severity by example
On Mon, May 4, 2026 at 6:09 AM Jakub Wilk <jwilk@...lk.net> wrote:
>
> * Collin Funk <collin.funk1@...il.com>, 2026-05-01 18:49:
> >* CVE-2026-35352
> >
> >We can see that uutils 'mkfifo' creates the fifo with world readable
> >and writable permissions and then uses chmod() which introduces a
> >TOCTOU race that can be exploited by another user creating a symbolic
> >link in it's place:
> >
> > $ mkfifo --version
> > mkfifo (uutils coreutils) 0.8.0
> > $ strace mkfifo -m 700 /tmp/fifo
> > [...]
> > umask(000) = 002
> > umask(002) = 000
> > mknodat(AT_FDCWD, "/tmp/fifo", S_IFIFO|0666) = 0
> > chmod("/tmp/fifo", 0700) = 0
>
> Creating the FIFO with default permission could allow other users to
> open it before the chmod(..., 0700) call. This is indeed a
> vulnerability, but unrelated to symlinks, and it's a different issue
> than the one in the description of CVE-2026-35352:
>
> >A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the
> >mkfifo utility of uutils coreutils. The utility creates a FIFO and then
> >performs a path-based chmod to set permissions. A local attacker with
> >write access to the parent directory can swap the newly created FIFO
> >for a symbolic link between these two operations.
>
> Note that this attack doesn't work in /tmp, because the sticky bit
> prevents the attacker from deleting or renaming other users' files. The
> victim would have to do something like "mkfifo /home/mallory/fifo". So,
> uh, don't do that?
>
> It's questionable if this is a vulnerability at all.
>
> --
> Jakub Wilk
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
