Canonical has published preliminary results of an independent security audit of the uutils coreutils (Rust Coreutils) toolkit, which is written in Rust and is partially used in Ubuntu instead of the GNU Coreutils package. The audit was conducted by Zellic, a company experienced in vulnerability analysis in Rust projects. During the review, 113 security issues were identified.
Currently, a report (PDF, 156 pages) is available with the results of the first phase of the audit, covering the most important utilities from the uutils set. In this first phase, conducted from December 2025 to January 2026, 73 vulnerabilities were found, of which 7 were marked as critical, 11 as dangerous, 29 as moderate risk, and 26 as non-threatening.
The second phase of the audit took place from February to March and covered secondary utilities that were not examined in the first phase. In the second phase, 40 vulnerabilities were found, the severity of which is yet to be detailed (the report is planned to be published later). Information about all identified issues has already been passed to the uutils developers, and most vulnerabilities were fixed in uutils releases 0.5-0.8 without undue publicity or linkage of corrections with vulnerability remediation.
The rust-coreutils package was included by default in the fall release of Ubuntu 25.10, but considering the issues identified during the audit in the LTS branch of Ubuntu 26.04, the cp, mv, and rm utilities from the GNU Coreutils set were reinstated. It is noted that as of April 22, 8 known race conditions remain unaddressed in these utilities. The other utilities are sourced from the rust-coreutils 0.8.0 release. In Ubuntu 26.10, the developers plan to fully transition to rust-coreutils.
Vulnerabilities in system utilities are dangerous because they are used in scripts that run with root privileges. For example, a vulnerability fixed in the uutils coreutils 0.3.0 release in the rm utility could have been exploited during the daily execution from the cron script /etc/cron.daily/apport, which runs with root privileges and recursively deletes the contents of the /var/crash directory, writable by all users in the system.
Among the vulnerabilities marked as critical in the first report:
- A vulnerability in the chroot utility, caused by processing the ‘—userspec’ option after calling chroot() but before dropping privileges. On systems with glibc, name resolution via the getpwnam() function leads to reading the file /etc/nsswitch.conf, which is used in NSS (Name Service Switch), and dynamically loading the libraries specified in it with NSS modules (libnss_*.so.2). Since the chroot() call is executed before handling NSS, the /etc/nsswitch.conf file is loaded relative to the new root, but the NSS libraries are loaded before privileges are dropped. If a user has write access to the new root, they can substitute their own NSS libraries and achieve code execution with root privileges.
- Changing file permissions after a named pipe (FIFO) creation failure by the mkfifo utility — if an existing file is specified as an argument, mkfifo will return an error but will not abort and will call set_permissions() to change the access permissions of the existing file. Given umask 022, the vulnerability allows changing file permissions to 644 (rw-r--r--) and gaining access to files that were not permitted to be read.
- Bypassing the ‘—preserve-root’ restrictions in the chmod utility, which prevent recursive operations relative to the root file system. The vulnerability (CVE-2026-35338) is caused by the code only checking for an exact match against ‘/’ and not performing any path canonicalization. To bypass the check, it is sufficient to use a path like ‘/../’ or a symbolic link to the root. The vulnerability is dangerous because if one can inject their path into a system script calling the chmod command, it can lead to recursive permission changes for all files in the file system.
- The rm utility allowed the processing of any abbreviations of the ‘—no-preserve-root’ option (‘—n’, ‘—no’, ‘—no-p’, ‘—no-pres’, etc.) to disable protection against executing recursive operations on the root (for example, one can specify ‘rm -rf —n /’ and mistakenly delete all data. In GNU Coreutils, such abbreviated options are prohibited.
- Bypassing the ‘—preserve-root’ restrictions in the rm utility, which prevent recursive operations relative to the root file system, by substituting a symbolic link to ‘/’.
- A lack of complete protection against specifying directories starting with a dot. For example, executing ‘rm -rf .’ will produce an error, but specifying ‘rm -rf ./’ or ‘rm -rf .///’ will silently remove the current directory.
- An error in the argument parsing code of the kill utility allows a signal to be sent to all processes in the system when using the process ID "-1" (kill -1).
Otherwise, most vulnerabilities fall under the TOCTOU (Time-Of-Check-To-Time-Of-Use) category, which implies a race condition that allows data to be altered between the validation of its correctness and the execution of an operation on it, such as replacing a file with a symbolic link in the moment between the end of the check and the beginning of the operation. In the context of using the cp and mv utilities in system scripts run with root privileges, such vulnerabilities can allow arbitrary files to be copied or overwritten.
Source: opennet.ru
