CVE-2026-35368: uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35368?
CVE-2026-35368 has been classified as a high severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2026-35368?
To fix CVE-2026-35368, update to the latest version of uutils coreutils that addresses this vulnerability.
What systems are affected by CVE-2026-35368?
CVE-2026-35368 affects uutils coreutils specifically when using the chroot utility with the --userspec option.
What is the exploit vector for CVE-2026-35368?
The exploit vector for CVE-2026-35368 involves gaining elevated privileges within a chroot environment via a Name Service Switch (NSS) injection.
Are there workarounds for CVE-2026-35368 pending a fix?
As a workaround for CVE-2026-35368, avoid using the --userspec option in chroot until the vulnerability is patched.