Cyber Resilience

CVE-2026-35361

Uutils Coreutils ≤ 0.6.0

Public PoC
Published
22 April 2026
Modified
27 April 2026
Patch / advisory
View advisory
CVSS Score v3.1 3.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0014 4th percentile
Risk Priority 20 floored blend · peak EPSS

Summary

CVE-2026-35361 is a low-severity Improper Preservation of Permissions (CWE-281) vulnerability in Uutils Coreutils. Its CVSS base score is 3.4 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-16 (Security and Privacy Attributes) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled…

more

nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

CWE(s)
CWE-281CWE-459

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Mislabeled device nodes created by flawed mknod allow bypassing SELinux MAC restrictions, directly enabling local privilege escalation via unauthorized device access.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-35352Same product: Uutils Coreutils
CVE-2026-35356Same product: Uutils Coreutils
CVE-2026-35359Same product: Uutils Coreutils
CVE-2026-35362Same product: Uutils Coreutils
CVE-2026-35355Same product: Uutils Coreutils
CVE-2026-35370Same product: Uutils Coreutils
CVE-2026-35372Same product: Uutils Coreutils
CVE-2026-35368Same product: Uutils Coreutils
CVE-2026-35351Same product: Uutils Coreutils
CVE-2026-35350Same product: Uutils Coreutils

Affected Assets

uutils
coreutils
≤ 0.6.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-16 Security and Privacy Attributes
  • AC-4 Information Flow Enforcement
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 8 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.1

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces mandatory access control policies (e.g., SELinux contexts) on device nodes so that mislabeled nodes created by the flawed mknod path cannot be accessed.

AC-16 Security and Privacy Attributes good match
prevent

Requires proper binding and atomic handling of security attributes (SELinux labels) during object creation, directly addressing the non-atomic create-then-label sequence.

AC-4 Information Flow Enforcement partial match
prevent

Enforces information-flow rules that would block unauthorized access to device nodes whose SELinux contexts were left in an incorrect default state.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing least-privilege permission policies and reviews directly prevents incorrect permission propagation on copy/restore/share operations.

PR.PS-06 mostly match
prevents

Secure-development practices and coding standards normally require proper resource release and cleanup.

ID.AM-08 partial match
prevents

Life-cycle management encompasses disposal of temporary resources but does not specifically target runtime cleanup bugs.

PR.DS-10 partial match
prevents

Explicitly calls for removing sensitive data after use, directly addressing one class of incomplete cleanup.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.10 Information deletion full match
degrades

Explicitly requires secure deletion of temporary or residual data, directly addressing incomplete cleanup.

A.5.15 Access control partial match
degrades

Access-control policy defines how permissions must be preserved when objects are copied or shared.

A.5.18 Access rights partial match
degrades

Access-rights provisioning and review processes directly address the risk of overly permissive copied objects.

A.8.2 Privileged access rights partial match
degrades

Privileged-access management includes rules for maintaining correct permissions on copied or restored data.

A.8.25 Secure development life cycle partial match
prevents

SDLC practices include cleanup steps, yet the weakness can still occur if those steps are omitted.

A.8.28 Secure coding partial match
prevents

Secure-coding rules can mandate explicit cleanup of temporary resources, but do not guarantee it.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Windows Server 2016 (1 rule)
  • V-224972 Active Directory Group Policy objects must have proper access control permissions. via CWE-281
Windows Server 2022 (1 rule)
  • V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. via CWE-281

References