Описание
chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)
Chmoder::chmod() only compares the literal argument against Path::new("/"), so the --preserve-root guard is bypassed by any path that resolves to root — a symlink to / or simply /../.
PoC — recursively chmods the entire filesystem to 000 despite --preserve-root:
Impact: --preserve-root is the documented safeguard against destructive recursive operations on /. Bypassing it allows chmod -R to alter permissions across the whole filesystem, causing a complete system breakdown. Recommendation: canonicalize the target path before comparing against root.
Remediation: Acknowledged by Canonical; fixed in commit 413055b3.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.1. Credit: Zellic.
Ссылки
- https://github.com/uutils/coreutils/security/advisories/GHSA-4c7q-4928-8445
- https://nvd.nist.gov/vuln/detail/CVE-2026-35338
- https://github.com/uutils/coreutils/pull/10033
- https://github.com/uutils/coreutils/commit/413055b378fa6fe2299c5e5f538c8e6e841ab810
- https://github.com/uutils/coreutils/releases/tag/0.6.0
Пакеты
uu_chmod
< 0.6.0
0.6.0
Связанные уязвимости
A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.
A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.
A vulnerability in the chmod utility of uutils coreutils allows users ...