The vulnerability in uutils coreutils' chroot utility occurs during user specification resolution via getpwnam() after entering the chroot but before privilege dropping. On glibc-based systems, NSS loads shared libraries (e.g., libnss_*.so.2) from the chroot directory. If the chroot directory (NEWROOT) is attacker-writable, malicious NSS modules can be injected, resulting in arbitrary root code execution. This flaw can be exploited for container escapes or privilege escalation. The CVSS 3.1 score is 7.2 (high), reflecting local attack vector with high impact on confidentiality, integrity, and availability. No patch or vendor remediation level is currently documented.

Successful exploitation allows an attacker with local access and write permissions to the chroot directory to execute arbitrary code as root. This can lead to full container escape or privilege escalation, compromising system confidentiality, integrity, and availability. The vulnerability requires high attack complexity and low privileges but no user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions to chroot directories to trusted users only and avoid using the --userspec option in untrusted environments. Monitor vendor channels for updates and apply patches promptly once released.