CVE-2026-35368

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

It was discovered that uutils coreutils mkfifo incorrectly continued processing when a target file already existed, applying default permissions to the existing file. A local attacker could possibly use this issue to obtain sensitive information or modify file permissions unexpectedly. (CVE-2026-35341)

It was discovered that uutils coreutils dd incorrectly suppressed errors during file truncation operations. A local attacker could possibly use this issue to cause silent data corruption. (CVE-2026-35344)

It was discovered that uutils coreutils tail incorrectly followed symbolic links when using the --follow=name option. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35345)

It was discovered that uutils coreutils sort crashed when processing filenames containing non-UTF-8 bytes. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35348)

It was discovered that uutils coreutils cp incorrectly preserved setuid and setgid bits when ownership changes failed. A local attacker could possibly use this issue to gain elevated privileges. (CVE-2026-35350)

It was discovered that uutils coreutils mv failed to preserve file ownership when moving files across file system boundaries. A local attacker could possibly use this issue to obtain sensitive information or cause unintended access restrictions. (CVE-2026-35351)

It was discovered that uutils coreutils mv had a time-of-check to time-of-use race condition in its extended attribute preservation logic. A local attacker with write access to a directory could possibly use this issue to modify security labels on unintended files. (CVE-2026-35354)

It was discovered that uutils coreutils cp had a race condition in its file creation logic, initially creating destination files with overly permissive modes. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35357)

It was discovered that uutils coreutils cp had a time-of-check to time-of-use race condition when handling symbolic links. A local attacker with write access to a directory could possibly use this issue to obtain sensitive information. (CVE-2026-35359)

It was discovered that uutils coreutils touch had a time-of-check to time-of-use race condition during file creation. A local attacker could possibly use this issue to cause data loss. (CVE-2026-35360)

It was discovered that uutils coreutils rm failed to recognize trailing slashes on the current directory path. A local attacker could possibly use this issue to cause data loss. (CVE-2026-35363)

It was discovered that uutils coreutils mv had a time-of-check to time-of-use race condition during cross-device operations. A local attacker with write access to a directory could possibly use this issue to overwrite arbitrary files. (CVE-2026-35364)

It was discovered that uutils coreutils nohup created its output file with world-readable permissions. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35367)

It was discovered that uutils coreutils chroot incorrectly resolved user specifications before dropping root privileges, allowing Name Service Switch modules to be loaded from the new root directory. A local attacker with write access to the chroot directory could possibly use this issue to execute arbitrary code as root. (CVE-2026-35368)

It was discovered that uutils coreutils ln failed to process filenames containing non-UTF-8 bytes, causing the utility to exit with an error. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35373)

It was discovered that uutils coreutils split had a time-of-check to time-of-use race condition in its input and output file validation. A local attacker with write access to a directory could possibly use this issue to cause data loss. (CVE-2026-35374)

It was discovered that uutils coreutils chcon had a time-of-check to time-of-use race condition during…