This vulnerability arises from the chroot utility in uutils coreutils resolving user specifications via getpwnam() after entering the chroot environment but before relinquishing root privileges. On systems using glibc, the NSS mechanism loads shared libraries such as libnss_*.so.2 from the chroot directory. If the chroot directory (NEWROOT) is writable by an attacker, they can place malicious NSS modules there, which the utility will load and execute with root privileges. This can lead to arbitrary code execution as root, facilitating full container escape or privilege escalation. The CVSS 3.1 score is 7.2, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with write access to the chroot directory to execute arbitrary code as root. This can lead to full container escape or privilege escalation, compromising system confidentiality, integrity, and availability. The vulnerability affects systems using uutils coreutils with glibc-based NSS implementations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running the chroot utility with the --userspec option in environments where the new root directory is writable by untrusted users. Restrict write permissions on the chroot directory to trusted users only to prevent malicious NSS module injection.