CVE-2026-35356

MEDIUM6.3EPSS 0.01%

uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition

發布日:2026/4/22修改日:2026/5/5
也稱為:GHSA-m26v-hjq3-x245DEBIAN-CVE-2026-35356

描述

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.

受影響套件(2)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM6.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

參考連結(6)