CVE-2026-35350

What it actually does

This is a local privilege-escalation flaw in the uutils coreutils implementation of cp. When cp is run with the preserve option, it can apply the source file permission mode, including setuid or setgid bits, even after ownership preservation fails. Correct behavior is to clear privileged bits when the destination file cannot retain the original owner or group. As a result, a low-privileged local user may be able to create a copy of a privileged executable that is owned by the user but still has setuid or setgid permissions, violating expected Unix permission semantics and potentially enabling unauthorized privilege gain depending on the copied program and local policy.

Why it matters to the business

Systems that rely on uutils coreutils may allow local users to create unexpected privileged executables, undermining host hardening controls and least-privilege assumptions. The most likely impact is local privilege escalation, unauthorized modification of files, or execution with elevated group/user privileges on multi-user Linux or Unix-like systems. The vulnerability has a moderate CVSS score, low EPSS, is not known to be in CISA KEV, and has no reported exploit maturity in the provided data, so it is lower urgency than actively exploited remote vulnerabilities; however, it should be addressed promptly on shared servers, build hosts, developer workstations, containers, and systems where untrusted users can run local commands.

How an attack unfolds

An attacker must already have local command execution as a low-privileged user. They identify a source file with setuid or setgid bits set and a situation where ownership preservation during copy will fail, such as copying a privileged file as an unprivileged user. They then invoke the affected uutils cp implementation with preservation enabled. Due to the flaw, cp may fail to preserve ownership but still copy the original privileged mode bits to the attacker-controlled destination. The attacker then attempts to execute or abuse the resulting setuid or setgid copy. Successful impact depends on the behavior of the copied executable, filesystem mount options, kernel protections, and whether the created file provides a usable path to elevated privileges.

How to fix it

Upgrade uutils coreutils to a version that corrects cp behavior when chown or ownership preservation fails. No fixed version was provided in the input, so track the upstream uutils coreutils advisory, distribution security errata, and package-manager updates. Where immediate upgrade is not available, consider replacing the affected cp implementation with GNU coreutils cp on security-sensitive systems, disabling use of uutils cp for privileged workflows, and removing or restricting setuid/setgid source files that non-privileged users can copy. Apply filesystem-level mitigations such as nosuid on user-writable mount points, temporary directories, shared workspaces, and build directories. Periodically remove unexpected setuid/setgid bits from user-writable paths and maintain a baseline of approved privileged binaries.

How to confirm the fix worked

Confirm the installed cp implementation and package version on representative systems, especially where uutils coreutils may replace GNU coreutils. Validate that copying a setuid or setgid source file with preserve mode does not leave privileged bits on the destination if ownership preservation fails. Confirm that user-writable filesystems are mounted with nosuid where appropriate. Run filesystem audits to identify files with setuid or setgid bits outside approved system paths and compare results against a known-good baseline. After patching or replacing cp, repeat the behavioral test and verify that privileged mode bits are cleared when chown fails.

Typical attack path

1. Gain local access to a system where uutils coreutils cp is installed and used.
2. Locate files with setuid or setgid permissions that are readable and copyable.
3. Trigger a copy operation using cp with permission preservation enabled.
4. Cause or rely on ownership preservation failure during the copy operation.
5. Obtain a destination file owned by the attacker or another non-original owner while retaining setuid or setgid bits.
6. Execute or manipulate the copied privileged file to attempt local privilege escalation or unauthorized access.
7. Cover tracks by deleting the copied file or clearing shell and audit artifacts where possible.

How to detect it

To determine whether this was already exploited, focus on filesystem state and local process/audit history. Search for setuid or setgid files in user-writable locations, home directories, temporary directories, build workspaces, shared project directories, and container volumes. Compare all privileged files against a known-good baseline of approved system binaries. Investigate privileged files owned by non-root users, files with recent creation or modification times, and files whose parent directory is writable by ordinary users. Review auditd, syslog, EDR telemetry, process accounting, shell history, and terminal session logs for cp executions using preserve options, followed by failed ownership changes and successful mode changes. In Linux audit logs, look for chown/fchown/fchownat failures with EPERM or EACCES associated with cp, followed by chmod/fchmod/fchmodat setting setuid or setgid bits. If suspicious files are found, preserve metadata, hash the files, identify the creating user/process where possible, review subsequent executions of those files, and check for privilege changes or unauthorized file modifications after their creation.

• cp -p
• cp --preserve
• cp --preserve=mode
• cp --preserve=all
• uutils coreutils
• uutils cp
• type=EXECVE
• a0="cp"
• a1="-p"
• a1="--preserve"
• type=SYSCALL msg=audit
• comm="cp"
• exe="/usr/bin/cp"
• syscall=chown
• syscall=fchown
• syscall=fchownat
• syscall=chmod
• syscall=fchmod
• syscall=fchmodat
• exit=-1
• EACCES
• EPERM
• mode=04755
• mode=02755
• mode=06755
• -perm -4000
• -perm -2000
• nosuid

What your security team should do

• Inventory systems using uutils coreutils and prioritize shared, multi-user, developer, CI/CD, and container-host environments.
• Patch or replace the affected uutils coreutils cp implementation as soon as an upstream or distribution fix is available.
• Apply nosuid to user-writable and shared filesystems wherever operationally feasible.
• Search for unexpected user-owned setuid or setgid files and remove or quarantine anything not part of an approved baseline.
• Enable or tune Linux audit rules for chmod, fchmod, fchmodat, chown, fchown, fchownat, and execve activity involving cp on sensitive systems.
• Review local accounts, sudoers policy, and privileged group membership on systems where suspicious privileged files are found.
• Educate administrators not to rely on cp -p behavior from affected uutils versions for security-sensitive file handling.
• Monitor upstream uutils coreutils release notes and distribution advisories because no fixed version was provided.