Loading story…
Ubuntu developers traced live image build failures in Ubuntu 24.04 to a compatibility gap between GNU Coreutils and the Rust implementation of cp used in some build contexts. The issue surfaced in livecd-rootfs workflows that invoked cp with the combined flags -afL, a combination accepted by GNU Coreutils but handled differently by Rust Coreutils.
Under Rust Coreutils, the option interaction caused cp to treat directory copying as non-recursive in some cases and return errors such as omitting directories, breaking image creation. The root cause was a behavioral mismatch in how archive mode -a interacts with -L symlink dereferencing, particularly whether archive semantics preserve links via -d or allow dereferencing to take precedence, exposing a subtle but operationally significant incompatibility in Ubuntu's build toolchain.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Ubuntu developers encountered a compatibility issue in Ubuntu 24.04 after replacing GNU Coreutils implementations with Rust Coreutils in some build contexts. The cp command with the combined flags "-afL" behaved differently, causing livecd-rootfs image-building failures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
git.launchpad.net
Open sourcediscourse.ubuntu.com
Open sourcegithub.com
Open sourcebugs.launchpad.net
Open sourceopennet.me
Open sourceopennet.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ubuntu reportedly postponed its planned adoption of the Rust-based `uutils coreutils` implementation for core commands including `cp`, `mv`, and `rm`, retaining GNU Coreutils for Ubuntu 26.04 LTS amid security and reliability concerns. The cross-platform Rust project had been slated to become the default implementation, but filesystem-path handling flaws raised concerns about its use in privileged system operations. The affected utilities reportedly contain symlink time-of-check-to-time-of-use (TOCTOU) race conditions: a local unprivileged user could replace an object after validation but before the command operates on it, redirecting a root-run operation to unintended files or directories. A cited attack path involves the root-executed `/etc/cron.daily/apport` cleanup job processing the user-writable `/var/crash` directory, potentially enabling unintended file operations or local privilege escalation.
Sep 14, 2026
An `oss-sec` disclosure reported that the Rust-based **uutils coreutils** project contains **113 audit findings**, including **44 assigned CVEs** (`CVE-2026-35338` through `CVE-2026-35381`), after a Zellic review tied to Canonical's evaluation of the package for Ubuntu 26.04. Canonical said most issues had been resolved, but the report said multiple vulnerabilities were still reproducible on a fully updated Ubuntu 26.04 system running uutils coreutils `0.8.0`. Because of **TOCTOU race conditions**, Canonical kept the GNU implementations of `cp`, `mv`, and `rm` rather than replacing them with uutils versions. The published issues span `mkfifo`, `nohup`, `tail`, and other utilities, and include **symlink attacks, unsafe file creation, permission and ownership handling flaws, incorrect exit codes, UTF-8 parsing bugs, and logic errors** that could enable privilege escalation, information disclosure, denial of service, data corruption, or destructive filesystem operations. A follow-up `oss-sec` reply focused on the `mkfifo` case, agreeing that the race condition remained valid while clarifying that the example's initial FIFO permissions would be shaped by `umask(002)`, producing mode `664` rather than `666` before a later `chmod(2)` call.
Jul 3, 2026
Imperva disclosed **CopyEscape**, tracked as `CVE-2026-17106`, a container-to-host arbitrary file-write vulnerability in Docker’s `docker cp` functionality that allows a malicious container to create or overwrite files outside the destination chosen by the user on the machine running the Docker CLI. The issue stems from a filesystem race in Docker’s archive creation path combined with unsafe symlink handling during extraction, turning a routine file copy from a container into a host write primitive. Docker confirmed the same CVE also affects `sbx cp` in Docker Sandboxes when copying files out of sandboxes. Imperva said exploitation was validated against Docker Engine `29.6.1` on Linux and Docker Desktop `4.81.0` on macOS, with impact ranging from compromise of the developer account using the CLI to **root code execution** when `docker cp` is run with elevated privileges. Fixes are available in Docker Engine and CLI `29.7.2` or later, Docker Desktop `4.86.0` or later, and Docker Sandboxes `0.38.0` or later.
Aug 12, 2026