EUVD-2026-25016
GHSA-mh5c-xrmh-m794
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.
AnalysisAI
Privilege escalation to root in uutils coreutils chroot utility allows low-privileged local attackers with write access to the chroot target directory to execute arbitrary code via malicious NSS module injection. The vulnerability triggers when --userspec option causes getpwnam() to load attacker-controlled shared libraries from the new root before dropping privileges, enabling container escape or full system compromise on glibc-based systems. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: identify all systems running uutils coreutils chroot utility using which chroot and rpm -qa | grep coreutils or dpkg -l | grep coreutils; audit write permissions on all chroot target directories using find / -type d -writable 2>/dev/null. Within 7 days: restrict write permissions on chroot target directories to trusted administrators only; disable chroot functionality where not operationally necessary; implement mandatory access controls (AppArmor/SELinux) to block NSS module loading from within chroot contexts. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today