GitHub Advisoryadvisory · crates.io

GHSA-x2wv-9p67-mh9w uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails

MEDIUM Published 2026-04-22 Modified 2026-04-29 Official page ↗
Aliases
CVE-2026-35350
Ecosystem
crates.io
Packages
coreutils
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Weaknesses
CWE-281
Reviewed
2026-04-29

Affected packages

• crates.io coreutils: <= 0.8.0 (no fix yet)

Description

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

Related

Alias · CVE (1)

  • CVE-2026-35350 The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. vulnerability

Weakness · CWE (1)

  • CWE-281 Improper Preservation of Permissions weakness

References