7
CVE-2026-35352
- EPSS 0.15%
- Veröffentlicht 22.04.2026 16:08:07
- Zuletzt bearbeitet 04.05.2026 18:16:28
- Quelle security@ubuntu.com
- CVE-Watchlists
- Unerledigt
Loginuutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.15% | 0.043 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@ubuntu.com | 7 | 1 | 5.9 |
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
https://github.com/uutils/coreutils/issues/10020
http://www.openwall.com/lists/oss-security/2026/05/04/4
http://www.openwall.com/lists/oss-security/2026/05/04/5
http://www.openwall.com/lists/oss-security/2026/05/04/6