Loading story…
Ubuntu reportedly postponed its planned adoption of the Rust-based uutils coreutils implementation for core commands including cp, mv, and rm, retaining GNU Coreutils for Ubuntu 26.04 LTS amid security and reliability concerns. The cross-platform Rust project had been slated to become the default implementation, but filesystem-path handling flaws raised concerns about its use in privileged system operations.
The affected utilities reportedly contain symlink time-of-check-to-time-of-use (TOCTOU) race conditions: a local unprivileged user could replace an object after validation but before the command operates on it, redirecting a root-run operation to unintended files or directories. A cited attack path involves the root-executed /etc/cron.daily/apport cleanup job processing the user-writable /var/crash directory, potentially enabling unintended file operations or local privilege escalation.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Ubuntu delayed its planned replacement of GNU Coreutils with Rust-based uutils coreutils for cp, mv, and rm after security and reliability concerns were identified. The reported symlink-handling TOCTOU races could allow a local unprivileged user to influence root-run file operations; a proof of concept targeted Apport's root-run cleanup of the user-writable /var/crash directory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
opennet.ru
Open sourceopennet.me
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An `oss-sec` disclosure reported that the Rust-based **uutils coreutils** project contains **113 audit findings**, including **44 assigned CVEs** (`CVE-2026-35338` through `CVE-2026-35381`), after a Zellic review tied to Canonical's evaluation of the package for Ubuntu 26.04. Canonical said most issues had been resolved, but the report said multiple vulnerabilities were still reproducible on a fully updated Ubuntu 26.04 system running uutils coreutils `0.8.0`. Because of **TOCTOU race conditions**, Canonical kept the GNU implementations of `cp`, `mv`, and `rm` rather than replacing them with uutils versions. The published issues span `mkfifo`, `nohup`, `tail`, and other utilities, and include **symlink attacks, unsafe file creation, permission and ownership handling flaws, incorrect exit codes, UTF-8 parsing bugs, and logic errors** that could enable privilege escalation, information disclosure, denial of service, data corruption, or destructive filesystem operations. A follow-up `oss-sec` reply focused on the `mkfifo` case, agreeing that the race condition remained valid while clarifying that the example's initial FIFO permissions would be shaped by `umask(002)`, producing mode `664` rather than `666` before a later `chmod(2)` call.
Jul 3, 2026
Ubuntu developers traced live image build failures in Ubuntu 24.04 to a compatibility gap between GNU Coreutils and the Rust implementation of `cp` used in some build contexts. The issue surfaced in `livecd-rootfs` workflows that invoked `cp` with the combined flags `-afL`, a combination accepted by GNU Coreutils but handled differently by Rust Coreutils. Under Rust Coreutils, the option interaction caused `cp` to treat directory copying as non-recursive in some cases and return errors such as omitting directories, breaking image creation. The root cause was a behavioral mismatch in how archive mode `-a` interacts with `-L` symlink dereferencing, particularly whether archive semantics preserve links via `-d` or allow dereferencing to take precedence, exposing a subtle but operationally significant incompatibility in Ubuntu's build toolchain.
Jul 12, 2026
A vulnerability tracked as **CVE-2026-29518** affects the `rsync` daemon and has been described as a symlink-race **time-of-check time-of-use (TOCTOU)** flaw. The issue is tied to daemon deployments configured with `use chroot = no`, a setting that removes the additional filesystem isolation normally provided by `chroot` and can increase exposure to path-handling attacks involving symbolic links. The flaw has been documented by multiple downstream vendors and trackers, including SUSE and Debian, and is reflected in upstream `rsync` release notes. Organizations running `rsync` in daemon mode should review whether `use chroot = no` is enabled, prioritize vendor patches for affected packages, and assess any services that expose `rsync` modules to untrusted clients or writable content paths.
Jun 29, 2026