CVE-2026-35357
MediumSummary
The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file before the permission change.
Risk Assessment
The risk is that sensitive data copied by cp may be temporarily accessible to unauthorized local users, leading to information leakage.
Recommendation
It is recommended to immediately update uutils coreutils to a version that fixes this vulnerability. Until the update, avoid copying sensitive files with cp in multi-user environments.
Original NVD description (English source)
The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file