A path traversal vulnerability in the uutils coreutils chmod utility allows local users to bypass root protection mechanisms, creating a risk of total system-wide permission loss.

The vulnerability exists because the chmod utility fails to canonicalize paths when validating the preserve-root safety mechanism. An attacker with local access can utilize path variants, such as /../ or symbolic links, to bypass these checks and execute destructive recursive operations on the entire root filesystem.

Successful exploitation results in the recursive modification of file permissions across the entire root directory, which can lead to a complete system breakdown and permanent loss of service availability. Given the CVSS score of 7.3, this flaw poses a high risk to system integrity and operational continuity, as it allows a low-privileged user to effectively sabotage the operating environment.

Immediate Action: Update the uutils coreutils package to version 0.6.0 or later to ensure the proper canonicalization of paths and enforcement of the preserve-root protection.

Proactive Monitoring: Audit system logs for unexpected recursive chmod operations or unusual file permission changes, particularly those targeting system-level directories.

Compensating Controls: Restrict access to the chmod utility for non-privileged users and enforce strict filesystem permissions to limit the potential scope of path traversal attempts.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to system stability and requires immediate attention. Organizations should prioritize updating their uutils coreutils installation to version 0.6.0 to rectify the path validation flaw and prevent potential unauthorized destructive actions against the root filesystem.