CVE-2016-2781 describes a local privilege escalation vulnerability in GNU coreutils' chroot command when used with the --userspec option. An attacker can escape the chroot environment by using a crafted TIOCSTI ioctl call to push characters into the terminal's input buffer. This vulnerability has a CVSS score of 6.5 (Medium), indicating a low attack complexity and requiring local access, but allowing for high integrity impact. There is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed on CISA's KEV catalog. Community discussion and media coverage are minimal, suggesting low active exploitation or public awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2016-2781
Dec 14, 2021chroot in GNU coreutils when used with --userspec allows local users to escape to the parent session via a crafted TIOCSTI ioctl call which pushes characters to the terminal's input buffer.
Feb 21, 2017coreutils: Non-privileged session can escape to the parent session in chroot
Feb 28, 2016