CVE-2026-35350 PUBLISHED

uutils coreutils cp Unexpected Privileged Executable Creation with -p

Assigner: canonical
Reserved: 02.04.2026 Published: 22.04.2026 Updated: 22.04.2026

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS Score: 6.6

Product Status

Vendor Uutils
Product coreutils
Versions Default: affected

Credits

  • Zellic finder

References

Problem Types

  • CWE-281: Improper Preservation of Permissions CWE

Impacts

  • CAPEC-122: Privilege Abuse