Bug 2460813 (CVE-2026-35362) - CVE-2026-35362 rust-coreutils: safe_traversal: missing TOCTOU protection on non-Linux Unix platforms
Summary: CVE-2026-35362 rust-coreutils: safe_traversal: missing TOCTOU protection on n...
Keywords:
Status: NEW
Alias: CVE-2026-35362
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2461194 2461195
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-22 17:04 UTC by OSIDB Bzimport
Modified: 2026-04-24 19:04 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-22 17:04:09 UTC
The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.


Note You need to log in before you can comment on or make changes to this bug.