CVE-2026-35368

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.1 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/uutils/coreutils/issues/10327	Exploit Issue Tracking Vendor Advisory
https://github.com/uutils/coreutils/issues/10327	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad en la utilidad chroot de uutils coreutils al usar la opción --userspec. La utilidad resuelve la especificación de usuario a través de getpwnam() después de entrar en el chroot, pero antes de abandonar los privilegios de root. En sistemas basados en glibc, esto puede activar el Name Service Switch (NSS) para cargar bibliotecas compartidas (p. ej., libnss_*.so.2) desde el nuevo directorio raíz. Si el NEWROOT es escribible por un atacante, pueden inyectar un módulo NSS malicioso para ejecutar código arbitrario como root, facilitando un escape completo del contenedor o una escalada de privilegios.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35368

Mitre link : CVE-2026-35368

CVE.ORG link : CVE-2026-35368

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2026-35368", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35368", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-23T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.1}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}]}], "published": "2026-04-22T17:16:40.560", "references": [{"url": "https://github.com/uutils/coreutils/issues/10327", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "https://github.com/uutils/coreutils/issues/10327", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation."}, {"lang": "es", "value": "Existe una vulnerabilidad en la utilidad chroot de uutils coreutils al usar la opci\u00f3n --userspec. La utilidad resuelve la especificaci\u00f3n de usuario a trav\u00e9s de getpwnam() despu\u00e9s de entrar en el chroot, pero antes de abandonar los privilegios de root. En sistemas basados en glibc, esto puede activar el Name Service Switch (NSS) para cargar bibliotecas compartidas (p. ej., libnss_*.so.2) desde el nuevo directorio ra\u00edz. Si el NEWROOT es escribible por un atacante, pueden inyectar un m\u00f3dulo NSS malicioso para ejecutar c\u00f3digo arbitrario como root, facilitando un escape completo del contenedor o una escalada de privilegios."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}