TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Lobsters — security tag

uutils coreutils CVEs

seclists.org via lim · 2 days ago · Read original ↗

ATT&CK techniques detected

6 predictions
T1068Exploitation for Privilege Escalation
87%
“tail _ test echo " original " > testfile # gnu tail timeout 2 tail - - follow = name testfile & sleep 0. 3 rm testfile & & ln - s / etc / passwd testfile sleep 0. 3 # output : " has been replaced with an untailable symbolic link " # uutils tail rm - f testfile & & echo " original…”
T1055.001Dynamic-link Library Injection
75%
“, libnss _ *. so. 2 ) from the new root directory. if the newroot is writable by an attacker, they can inject a malicious nss module to execute arbitrary code as root, facilitating a full container escape or privilege escalation. * cve - 2026 - 35369 : an argument parsing error i…”
T1222.002Linux and Mac Permissions
71%
“s uid / gid rather than the source ' s metadata. this flaw breaks backups and migrations, causing files moved by a privileged user ( e. g., root ) to become root - owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners. * cve - 2…”
T1068Exploitation for Privilege Escalation
60%
“, libnss _ *. so. 2 ) from the new root directory. if the newroot is writable by an attacker, they can inject a malicious nss module to execute arbitrary code as root, facilitating a full container escape or privilege escalation. * cve - 2026 - 35369 : an argument parsing error i…”
T1574.006Dynamic Linker Hijacking
53%
“##5 : the mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. instead of preserving symlinks, the implementation expands them, copying the linked targets as real files or directories at the destina…”
T1574.001DLL
32%
“of uutils coreutils causes the corruption of output filenames when provided with non - utf - 8 prefix or suffix inputs. the implementation utilizes to _ string _ lossy ( ) when constructing chunk filenames, which automatically rewrites invalid byte sequences into the utf - 8 repl…”

Summary

Comments