CVE-2026-93658 in Coreutils
Summary
by MITRE • 09/18/2026
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in uutils coreutils prior to version 0.10.0 represents a critical race condition and logic error within the installation utilities, specifically affecting how file permissions are managed during package or script installations. The core technical flaw lies in the sequence of operations performed when installing files with elevated privileges. When an installer attempts to set specific ownership on a destination file, it first applies the requested permission bits, including potentially dangerous modes such as setuid and setgid. Only after these permissions are applied does the utility attempt to change the file owner using chown or similar system calls. This ordering creates a window of opportunity where the file exists with elevated privileges but retains ownership by the user who invoked the installation process rather than the intended target, typically root or another privileged service account.
This behavior is particularly dangerous on systems that enforce capability restrictions or use strict security policies like SELinux or AppArmor, although it remains exploitable in standard Linux environments as well. If the operation to change file ownership fails due to insufficient permissions, filesystem constraints, or other errors, the utility does not revert the permission changes before exiting. Consequently, a setuid executable is left on the disk owned by an unprivileged user but retaining its ability to execute with elevated privileges. This effectively bypasses standard access controls because any local user can now invoke this binary and gain root-level access or other high-privilege capabilities depending on how the specific utility was compiled and configured.
The operational impact of this vulnerability is severe, as it allows for a straightforward privilege escalation attack from an unprivileged account to full system control. An attacker who has write access to directories where coreutils installation scripts operate can craft inputs that trigger ownership changes while ensuring those changes fail. By doing so, they leave behind setuid binaries owned by themselves but executable with root privileges. This undermines the fundamental principle of least privilege and compromises the integrity of the entire operating system. The attack does not require complex exploitation techniques; it relies on predictable behavior in standard installation routines that many administrators assume are secure due to their widespread use.
From a classification perspective, this vulnerability aligns closely with CWE-250, which describes execution with unnecessary privileges, and CWE-732, concerning incorrect permission assignment for critical resources. In the context of the MITRE ATT&CK framework, this flaw facilitates Initial Access via Local Privilege Escalation techniques such as T1068 Exploitation for Privilege Escalation or potentially T1548 Abuse Elevation Control Mechanism if specific capability restrictions are bypassed through this method. The vulnerability highlights a common pitfall in system administration tools where atomicity of permission and ownership changes is not guaranteed, leading to transient but exploitable states that persist after the tool exits.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary solution is to upgrade uutils coreutils to version 0.10.0 or later, where this logic error has been corrected by ensuring that ownership changes are attempted before permission bits like setuid and setgid are applied, or by reverting permissions if the ownership change fails. For systems unable to update immediately, administrators should audit installed binaries for unexpected setuid flags owned by non-root users using commands such as find / -perm -4000 -o -perm -2000. Additionally, implementing strict file integrity monitoring can help detect these unauthorized changes in real-time. Developers of similar utilities must adopt a defense-in-depth approach where permission modifications are treated with the same caution as ownership changes, ensuring that no privileged state is left behind if any part of the setup process fails.