Bug 2460777 (CVE-2026-35368)

Summary: CVE-2026-35368 rust-coreutils: uutils coreutils: Privilege escalation and arbitrary code execution in chroot utility
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: crizzo, gtanzill, jbuscemi, jmitchel, kaycoth, kshier, teagle
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in uutils coreutils. The `chroot` utility, when used with the `--userspec` option, resolves user specifications after entering a restricted environment (chroot) but before relinquishing root privileges. This can cause the Name Service Switch (NSS), a system for resolving system information, to load malicious shared libraries from the new restricted directory if an attacker has write access. Successful exploitation allows an attacker to execute arbitrary code as root, potentially leading to privilege escalation or a full container escape.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2463770, 2463771    
Bug Blocks:    

Description OSIDB Bzimport 2026-04-22 17:02:07 UTC 
A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.