CVE-2026-35353

Katalog CVE

CVSS 3.3 · Low EPSS 0,12%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada uutils coreutils. Skor CVSS 3.1 3.3 (Low) menurut ubuntu.com.

Deskripsi (NVD)

The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber ubuntu.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/uutils/coreutils/pull/10036 issue tracking · patch
• https://github.com/uutils/coreutils/releases/tag/0.6.0 release notes