Privilege Escalation in uutils coreutils via Incorrect File Ownership Handling

The uutils coreutils project, a Rust-based implementation of GNU coreutils, is affected by a privilege escalation vulnerability (CVE-2026-93658) in versions prior to 0.10.0. The 'install' utility implementation incorrectly sequences the application of setuid and setgid bits relative to the ownership change operation. Specifically, the utility applies these permission bits before verifying the success of the chown operation. In environments with capability restrictions or file system constraints where ownership changes are prone to failure, an attacker can manipulate the process to ensure ownership changes fail, resulting in a setuid executable being created that is still owned by the privileged user who invoked the 'install' command. This allows an attacker to execute the leftover file with elevated privileges. This flaw impacts systems where uutils 'install' is used as part of deployment or build processes executed by privileged accounts.

Impact

Successful exploitation allows a local attacker to execute arbitrary code with the privileges of the user running the 'install' command, typically root or a high-privileged service account. This could lead to full system compromise in environments where automated installation scripts are frequently used.

Recommendation

• Upgrade uutils coreutils to version 0.10.0 or later immediately to address the insecure sequencing of permission and ownership operations.
• Audit automation scripts or deployment pipelines that utilize the 'install' utility to determine if they are running in environments prone to ownership change failures, such as those with restricted Linux capabilities or specific file system mounting options (e.g., nosuid or restricted user namespaces).
• Implement monitoring for the creation of new setuid or setgid binaries in system directories, particularly those following automated deployment or installation activity.