GHSA-4C7Q-4928-8445

Vulnerability from github – Published: 2026-07-06 17:41 – Updated: 2026-07-06 17:41
VLAI
Summary
chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)
Details

Chmoder::chmod() only compares the literal argument against Path::new("/"), so the --preserve-root guard is bypassed by any path that resolves to root — a symlink to / or simply /../.

if self.recursive && self.preserve_root && file == Path::new("/") {
    return Err(ChmodError::PreserveRoot("/".to_string()).into());
}

PoC — recursively chmods the entire filesystem to 000 despite --preserve-root:

chmod -R --preserve-root 000 /../ -v

Impact: --preserve-root is the documented safeguard against destructive recursive operations on /. Bypassing it allows chmod -R to alter permissions across the whole filesystem, causing a complete system breakdown. Recommendation: canonicalize the target path before comparing against root.

Remediation: Acknowledged by Canonical; fixed in commit 413055b3.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.1. Credit: Zellic.

Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "uu_chmod"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35338"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T17:41:45Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "`Chmoder::chmod()` only compares the literal argument against `Path::new(\"/\")`, so the `--preserve-root` guard is bypassed by any path that *resolves* to root \u2014 a symlink to `/` or simply `/../`.\n\n```\nif self.recursive \u0026\u0026 self.preserve_root \u0026\u0026 file == Path::new(\"/\") {\n    return Err(ChmodError::PreserveRoot(\"/\".to_string()).into());\n}\n```\n\n**PoC** \u2014 recursively chmods the entire filesystem to `000` despite `--preserve-root`:\n\n```\nchmod -R --preserve-root 000 /../ -v\n```\n\n**Impact:** `--preserve-root` is the documented safeguard against destructive recursive operations on `/`. Bypassing it allows `chmod -R` to alter permissions across the whole filesystem, causing a complete system breakdown. Recommendation: canonicalize the target path before comparing against root.\n\n**Remediation:** Acknowledged by Canonical; fixed in commit 413055b3.\n\n---\n_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.1. Credit: Zellic._",
  "id": "GHSA-4c7q-4928-8445",
  "modified": "2026-07-06T17:41:45Z",
  "published": "2026-07-06T17:41:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/security/advisories/GHSA-4c7q-4928-8445"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35338"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/pull/10033"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/commit/413055b378fa6fe2299c5e5f538c8e6e841ab810"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/uutils/coreutils"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uutils/coreutils/releases/tag/0.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.