A vulnerability in the su-exec utility up to version 0.3 allows local authenticated attackers to escalate privileges to root via malformed numeric identifiers.

The application utilizes strtol to parse user-provided numeric identifiers without validating the range before assigning them to uid_t and gid_t types. This causes large numeric values to truncate to zero, which corresponds to the root user identifier, allowing a local authenticated attacker to execute programs with root privileges.

Successful exploitation of this vulnerability results in full privilege escalation to the root user on the affected host. Given the CVSS score of 7.8, this poses a significant risk to system integrity and confidentiality, as an attacker can bypass intended security boundaries to gain administrative control over the operating system.

Immediate Action: Monitor for official security patches from the vendor or maintainer and apply them immediately once available.

Proactive Monitoring: Review system and access logs for unusual command execution patterns or attempts to pass large numeric values as user or group identifiers to su-exec.

Compensating Controls: Restrict access to the su-exec binary to only essential system services and users, ensuring that unprivileged accounts cannot execute the utility.

Public Exploit Available: Yes (a published proof-of-concept exists, referenced via the provided Gist and research write-up).

This vulnerability represents a high-severity risk due to the potential for total system compromise. Administrators must prioritize the identification of all instances of su-exec within their environment and apply updates as soon as the maintainer releases a fix. Until a patch is deployed, strictly limit the ability of low-privileged users to invoke the su-exec binary to prevent privilege escalation attempts.