{"id":169899,"date":"2026-04-24T18:24:34","date_gmt":"2026-04-24T16:24:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rust-coreutils-vyyavleno-113-uyazvimostej-v-ubuntu-26-04-vozvrashheny-cp-mv-i-rm-iz-gnu-coreutils"},"modified":"2026-04-24T18:24:34","modified_gmt":"2026-04-24T16:24:34","slug":"v-rust-coreutils-vyyavleno-113-uyazvimostej-v-ubuntu-26-04-vozvrashheny-cp-mv-i-rm-iz-gnu-coreutils","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-rust-coreutils-vyyavleno-113-uyazvimostej-v-ubuntu-26-04-vozvrashheny-cp-mv-i-rm-iz-gnu-coreutils","title":{"rendered":"113 vulnerabilities have been identified in Rust Coreutils. cp, mv, and rm from GNU Coreutils have returned in Ubuntu 26.04.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Canonical has published preliminary results of an independent security audit of the uutils coreutils (Rust Coreutils) toolkit, which is written in Rust and is partially used in Ubuntu instead of the GNU Coreutils package. The audit was conducted by Zellic, a company experienced in vulnerability analysis in Rust projects. During the review, 113 security issues were identified. <\/p>\n
A report (PDF, 156 pages) with the results of the first stage of the audit, covering the most important utilities from the uutils set, is now available. In the first stage, conducted from December 2025 to January 2026, 73 vulnerabilities were identified, of which 7 were marked as critical, 11 as dangerous, 29 as medium risk, and 26 as low risk. <\/p>\n
The second phase of the audit took place from February to March and covered secondary utilities that were not examined in the first phase. In the second phase, 40 vulnerabilities were found, the severity of which is yet to be detailed (the report is planned to be published later). Information about all identified issues has already been passed to the uutils developers, and most vulnerabilities were fixed in uutils releases 0.5-0.8 without undue publicity or linkage of corrections with vulnerability remediation. <\/p>\n
The rust-coreutils package was included by default in the fall release of Ubuntu 25.10, but considering the issues identified during the audit in the LTS branch of Ubuntu 26.04, the cp, mv, and rm utilities from the GNU Coreutils set were reinstated. It is noted that as of April 22, 8 known race conditions remain unaddressed in these utilities. The other utilities are sourced from the rust-coreutils 0.8.0 release. In Ubuntu 26.10, the developers plan to fully transition to rust-coreutils. <\/p>\n
Vulnerabilities in system utilities are dangerous because they are used in scripts that run with root privileges. For example, a vulnerability fixed in the uutils coreutils 0.3.0 release in the rm utility could have been exploited during the daily execution from the cron script \/etc\/cron.daily\/apport, which runs with root privileges and recursively deletes the contents of the \/var\/crash directory, writable by all users in the system. <\/p>\n
Among the vulnerabilities marked as critical in the first report: <\/p>\n
\n
A vulnerability in the chroot utility, caused by the processing of the --userspec option after the chroot() call but before privilege dropping. On systems with glibc, name resolution via the getpwnam() function leads to reading the \/etc\/nsswitch.conf file used in NSS (Name Service Switch) and dynamically loading the libraries specified in it with NSS modules (libnss_*.so.2). Since the chroot() call is executed before processing NSS, the \/etc\/nsswitch.conf file is loaded relative to the new root, but NSS libraries are loaded before privilege dropping. If a user has write access to the new root, they can substitute their own NSS libraries and achieve code execution with root privileges.\n
Changing file permissions after failing to create a named pipe (FIFO) with the mkfifo utility \u2014 if an existing file is specified as an argument, mkfifo will return an error, but it will not crash; instead, it will call set_permissions() and change the permissions of the existing file. Considering umask 022, the vulnerability allows changing the file permissions to 644 (rw-r--r--) and gaining access to files that were not permitted for reading.\n
Bypassing the --preserve-root restrictions in the chmod utility, which prevent performing recursive operations relative to the root of the file system. The vulnerability (CVE-2026-35338) is caused by the fact that the code only checked for an exact match with the '\/' path and did not canonicalize the file path. To bypass the check, it is sufficient to use a path like '\/..\/' or a symbolic link to the root. The vulnerability is dangerous because if one can inject their path into a system script that calls the chmod command, it can lead to recursive changes in permissions for all files in the file system.\n
In the rm utility, it was possible to process any abbreviations of the option «—no-preserve-root» («—n», «—no», «—no-p», «—no-pres», etc.) to disable protection against executing recursive operations on the root (for example, specifying «rm -rf —n \\\/» could accidentally delete all data. In GNU Coreutils, such abbreviated options are prohibited.\n
Bypassing the restrictions of «—preserve-root» in the rm utility, which prevents recursive operations relative to the root of the filesystem, by substituting a symbolic link to «\\\/».\n
The lack of proper protection against specifying directories that start with a dot. For example, when executing «rm -rf .», the utility will produce an error, but when specifying «rm -rf .\\\/» or «rm -rf .\/\/\/\/», it will silently delete the current directory.\n
An error in the argument parsing code of the kill utility allows sending a signal to all processes in the system when specifying the process identifier «-1» (kill -1). <\/ul>\n
Otherwise, most vulnerabilities fall under the TOCTOU (Time-Of-Check-To-Time-Of-Use) category, which implies a race condition that allows data to be altered between the validation of its correctness and the execution of an operation on it, such as replacing a file with a symbolic link in the moment between the end of the check and the beginning of the operation. In the context of using the cp and mv utilities in system scripts run with root privileges, such vulnerabilities can allow arbitrary files to be copied or overwritten. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"