A high-severity flaw in uutils coreutils allows local attackers to achieve root-level code execution and container escape via malicious library injection.

The vulnerability involves an untrusted search path (CWE-426) where the chroot utility resolves user specifications via getpwnam() after entering a chroot environment but before dropping root privileges. On glibc systems, this allows an attacker to inject a malicious Name Service Switch module from a writable root directory, leading to arbitrary code execution with root privileges.

The exploitation of this vulnerability results in a total compromise of the affected system or container. Given the CVSS score of 7.8, it represents a significant risk to environment integrity, potentially allowing lateral movement within a containerized architecture or full host takeover. Unauthorized root access can lead to complete data exfiltration, persistent backdoors, and severe operational disruption.

Immediate Action: Restrict the use of the chroot utility with the --userspec option until a security patch is provided by the vendor. Ensure that any directories used as a chroot target are strictly read-only for non-privileged users.

Proactive Monitoring: Monitor system logs for unexpected library loading events or unauthorized attempts to modify files within chroot environments. Audit process execution chains to identify anomalous behavior originating from coreutils.

Compensating Controls: Implement file system integrity monitoring and ensure that the root directory used for chroot operations does not contain writable paths that could be leveraged for library injection.

Public Exploit Available: Unknown.

This vulnerability presents a severe risk of privilege escalation and container escape. Security teams should prioritize identifying instances where uutils coreutils is utilized within their infrastructure. Until official patches are released, enforce strict write permissions on chroot environments to prevent the injection of malicious modules and minimize the attack surface.