Chroot Vulnerability Allows Root Privileges via Malicious NSS Modules

The National Vulnerability Database has identified CVE-2026-35368, a critical flaw in the uutils coreutils chroot utility. The vulnerability arises when the –userspec option is used. The system resolves user specifications using getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this sequence can be exploited. The Name Service Switch (NSS) mechanism may load shared libraries from the newly established root directory. If an attacker can write to this NEWROOT, they can plant a malicious NSS module. This module then executes arbitrary code with root privileges, enabling a full container escape or significant privilege escalation.

The National Vulnerability Database highlights a CVSS score of 7.8 (HIGH) for this issue. The attack vector is local (AV:L), requires low privileges (PR:L), and has a high complexity (AC:H). Crucially, it allows for significant system modification (S:C) leading to complete confidentiality, integrity, and availability compromise (C:H/I:H/A:H). This means a compromised system could be fully taken over.

Defenders must prioritize patching or updating uutils coreutils to mitigate CVE-2026-35368. For containerized environments, strict controls on write access to new root directories are essential. Auditing the Name Service Switch configuration and loaded modules within chroot environments can also provide early detection of malicious activity. Understanding the attacker’s calculus here is simple: gain initial limited access, then leverage this chroot flaw for full root compromise.