CVE-2026-35339: uutils coreutils Information Disclosure

CVE-2026-35339 Overview

The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.

Critical Impact

Automated scripts and deployment pipelines relying on chmod -R exit codes may fail silently, leaving sensitive files with incorrect permissions and creating potential security gaps in file access controls.

Affected Products

• uutils coreutils (versions prior to 0.6.0)

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-35339 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-35339

Vulnerability Analysis

This vulnerability falls under CWE-253 (Incorrect Check of Function Return Value), where the chmod utility in uutils coreutils fails to properly aggregate and report errors that occur during recursive file permission changes. When operating in recursive mode with the -R flag, the utility processes files sequentially but only considers the outcome of the final file operation when determining the overall exit code.

The impact is particularly concerning in automated environments where scripts depend on exit codes to verify successful permission changes. A script might attempt to set restrictive permissions on a directory tree containing files owned by different users. If the utility encounters "Operation not permitted" errors on files it cannot modify but successfully processes the final file, the exit code will be 0 (success). The calling script has no indication that critical files were not modified, potentially leaving sensitive data accessible when it should have been restricted.

Root Cause

The root cause lies in the exit code handling logic within the recursive chmod implementation. Rather than accumulating error states across all processed files and returning a non-zero exit code if any operation failed, the implementation overwrites the return value with each file processed. This design flaw means only the last file's operation result influences the final exit code, violating the expected POSIX behavior where any encountered error should result in a non-zero exit status.

Attack Vector

This vulnerability requires local access and low privileges to exploit. An attacker could exploit this behavior in environments where:

1. Automated deployment or configuration scripts use chmod -R to set security-critical permissions
2. The scripts rely on exit codes to verify successful permission changes
3. The attacker has placed files in the target directory tree that cannot be modified by the script's user

By strategically placing unmodifiable files early in the directory traversal order, an attacker could cause permission-setting scripts to fail silently, leaving files with incorrect permissions. The scripts would continue execution believing permissions were successfully set, potentially exposing sensitive data or allowing unauthorized access to restricted resources.

Detection Methods for CVE-2026-35339

Indicators of Compromise

• Scripts using chmod -R completing successfully but with files retaining incorrect permissions
• Log entries showing "Operation not permitted" errors from chmod operations that reported success
• Inconsistent file permissions across directory trees that should have uniform access controls
• Automated deployment logs showing successful permission changes with post-verification failures

Detection Strategies

• Implement post-execution permission verification in scripts that use recursive chmod operations
• Monitor for discrepancies between expected and actual file permissions after deployment scripts run
• Add explicit logging of chmod stderr output separate from exit code checking
• Deploy file integrity monitoring to detect unexpected permission states

Monitoring Recommendations

• Enable verbose logging for all chmod operations in automation scripts to capture individual file errors
• Implement automated permission auditing after deployment or configuration changes
• Create alerts for permission verification failures in CI/CD pipelines
• Monitor system logs for "Operation not permitted" messages associated with permission management operations

How to Mitigate CVE-2026-35339

Immediate Actions Required

• Upgrade uutils coreutils to version 0.6.0 or later which contains the fix
• Review automated scripts that use chmod -R and add explicit permission verification steps
• Audit recent deployments for potential permission inconsistencies caused by this behavior
• Consider using the traditional GNU coreutils chmod until upgrade is complete

Patch Information

The fix for this vulnerability is available in uutils coreutils version 0.6.0. The patch properly accumulates error states during recursive operations and returns a non-zero exit code if any file operation fails. For detailed information about the fix, see the GitHub Pull Request and the GitHub Release Tag 0.6.0.

Workarounds

• Wrap chmod -R calls with explicit permission verification using find and stat commands
• Capture and parse stderr output from chmod operations to detect individual file errors
• Use alternative permission management tools that properly report aggregated errors
• Implement custom wrapper scripts that verify permissions on all target files after chmod completes

# Workaround: Verify permissions after recursive chmod
chmod -R 750 /path/to/directory 2>&1 | tee /tmp/chmod_errors.log

# Check for any errors in the output
if grep -q "Operation not permitted\|Permission denied" /tmp/chmod_errors.log; then
    echo "ERROR: Some files could not be modified"
    exit 1
fi

# Alternative: Verify expected permissions were applied
find /path/to/directory -type f ! -perm 750 -print | head -n 1 | grep -q . && {
    echo "ERROR: Permission verification failed"
    exit 1
}