The chmod utility in uutils coreutils versions before 0.6.0 contains a vulnerability where the --preserve-root safety mechanism is bypassed. The implementation only checks if the target path is literally '/', failing to canonicalize the path. This allows attackers or accidental users to use path variants like '/../' or symbolic links to perform recursive destructive operations (e.g., chmod -R 000) on the entire root filesystem. This results in loss of permissions across the system and can cause complete system breakdown. The advisory is a duplicate and withdrawn, referencing GHSA-4c7q-4928-8445 for the original report.

Successful exploitation allows an attacker or user with limited privileges to bypass the --preserve-root safeguard in chmod, leading to recursive permission changes on the root filesystem. This can cause system-wide permission loss, potentially rendering the system unusable or causing a complete system breakdown. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory GHSA-4c7q-4928-8445 for current remediation guidance. Until a fix is applied, avoid running chmod with recursive operations on paths that could be manipulated to bypass --preserve-root. Monitor official uutils coreutils updates for patches addressing this issue.