UBUNTU-CVE-2026-35368: High severity ubuntu/rust-coreutils vulnerability
A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Exposure requires use of the chroot utility with the --userspec option on a glibc-based system, where the specified new root directory is writable by an attacker. This can enable a full container escape or local privilege escalation.
What must an attacker be able to do to exploit this?
The attacker needs the ability to write into the NEWROOT directory and place a malicious NSS shared library there. They also need chroot to be invoked with --userspec, so that user resolution occurs after entering the new root while privileges are still root.
Is the default chroot behavior affected?
The described issue is specifically tied to use of the --userspec option. The provided information does not indicate that invocations without --userspec are affected.
What can be done if patching cannot happen immediately?
Avoid invoking chroot with --userspec when the new root may be attacker-writable. Restrict write access to directories used as NEWROOT so untrusted users cannot add NSS modules or other files to them.