CVE-2026-35341

When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).

$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret      # uutils:
prw-r--r-- secret   # changed to 644 (GNU leaves it 000)

Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.

Remediation: Acknowledged by Canonical; fixed in PR #10376.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.

Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pmf6-rcx4-v53v. This link is maintained to preserve external references.

Original Description

A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.

A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.

It was discovered that uutils coreutils mkfifo incorrectly continued processing when a target file already existed, applying default permissions to the existing file. A local attacker could possibly use this issue to obtain sensitive information or modify file permissions unexpectedly. (CVE-2026-35341)

It was discovered that uutils coreutils dd incorrectly suppressed errors during file truncation operations. A local attacker could possibly use this issue to cause silent data corruption. (CVE-2026-35344)

It was discovered that uutils coreutils tail incorrectly followed symbolic links when using the --follow=name option. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35345)

It was discovered that uutils coreutils sort crashed when processing filenames containing non-UTF-8 bytes. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35348)

It was discovered that uutils coreutils cp incorrectly preserved setuid and setgid bits when ownership changes failed. A local attacker could possibly use this issue to gain elevated privileges. (CVE-2026-35350)

It was discovered that uutils coreutils mv failed to preserve file ownership when moving files across file system boundaries. A local attacker could possibly use this issue to obtain sensitive information or cause unintended access restrictions. (CVE-2026-35351)

It was discovered that uutils coreutils mv had a time-of-check to time-of-use race condition in its extended attribute preservation logic. A local attacker with write access to a directory could possibly use this issue to modify security labels on unintended files. (CVE-2026-35354)

It was discovered that uutils coreutils cp had a race condition in its file creation logic, initially creating destination files with overly permissive modes. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35357)

It was discovered that uutils coreutils cp had a time-of-check to time-of-use race condition when handling symbolic links. A local attacker with write access to a directory could possibly use this issue to obtain sensitive information. (CVE-2026-35359)

It was discovered that uutils coreutils touch had a time-of-check to time-of-use race condition during file creation. A local attacker could possibly use this issue to cause data loss. (CVE-2026-35360)

It was discovered that uutils coreutils rm failed to recognize trailing slashes on the current directory path. A local attacker could possibly use this issue to cause data loss. (CVE-2026-35363)

It was discovered that uutils coreutils mv had a time-of-check to time-of-use race condition during cross-device operations. A local attacker with write access to a directory could possibly use this issue to overwrite arbitrary files. (CVE-2026-35364)

It was discovered that uutils coreutils nohup created its output file with world-readable permissions. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35367)

It was discovered that uutils coreutils chroot incorrectly resolved user specifications before dropping root privileges, allowing Name Service Switch modules to be loaded from the new root directory. A local attacker with write access to the chroot directory could possibly use this issue to execute arbitrary code as root. (CVE-2026-35368)

It was discovered that uutils coreutils ln failed to process filenames containing non-UTF-8 bytes, causing the utility to exit with an error. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35373)

It was discovered that uutils coreutils split had a time-of-check to time-of-use race condition in its input and output file validation. A local attacker with write access to a directory could possibly use this issue to cause data loss. (CVE-2026-35374)

It was discovered that uutils coreutils chcon had a time-of-check to time-of-use race condition during…