Chroot Escape Vulnerability in GNU Coreutils Allows Unauthorized Session Access
CVE-2016-2781

6.5MEDIUM

Key Information:

Vendor
Gnu
Status
Coreutils
Vendor
CVE Published:
7 February 2017

Summary

A vulnerability in the GNU coreutils package allows local users to escape from a chroot jail when using the --userspec option. The vulnerability arises from the improper handling of the TIOCSTI ioctl call, which can be exploited to push arbitrary characters into the terminal's input buffer, facilitating unauthorized access to the parent session. This flaw can lead to a significant security risk if exploited, as it undermines the intended restrictions provided by the chroot environment.

References

http://www.openwall.com/lists/oss-security/2016/02/28/2
mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/02/28/3
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.