PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-2781 Gnu CVE debrief

CVE-2016-2781 describes a local escape issue in GNU coreutils chroot when used with --userspec. According to the CVE description, a crafted TIOCSTI ioctl call can push characters into the terminal input buffer, allowing a local user to break out of the intended chroot/session boundary and affect the parent session. NVD rates the issue as Medium and maps it to a local, low-complexity attack that requires privileges and user interaction.

Vendor
Gnu
Product
CVE-2016-2781
CVSS
MEDIUM 4.6
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-07
Original CVE updated
2026-05-13
Advisory published
2017-02-07
Advisory updated
2026-05-13

Who should care

System administrators, Linux platform teams, and security engineers running GNU coreutils chroot workflows with --userspec, especially where interactive terminal access is available to local users or delegated operators.

Technical summary

The reported weakness is a terminal-input handling problem in a chroot context rather than a memory-safety flaw. NVD classifies the issue under CWE-20 and gives a CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating a local attack that needs some privileges and user interaction, with scope change across the session boundary. The supplied NVD record lists GNU coreutils as the affected CPE family.

Defensive priority

Medium. The issue is local, requires user interaction, and is not listed in KEV in the supplied data, but it can still undermine expected isolation for terminal-driven chroot usage.

Recommended defensive actions

  • Upgrade GNU coreutils to a version that includes the vendor's fix or distro backport for CVE-2016-2781.
  • Avoid relying on chroot with --userspec as a hard security boundary in interactive terminal workflows.
  • Restrict local shell and terminal access on systems that use chroot-based isolation for administrative tasks.
  • Review automation, admin scripts, and container/bootstrap workflows that invoke chroot --userspec and confirm they are patched.
  • Apply least-privilege controls for users who can access terminals on affected hosts.

Evidence notes

The CVE description states that chroot in GNU coreutils, when used with --userspec, can be abused via a crafted TIOCSTI ioctl call to escape to the parent session. NVD's record provides the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N and maps the issue to CWE-20. The supplied references include openwall oss-security mailing-list threads and an Apache MINA dev mailing-list thread cited by NVD as related source material.

Official resources

CVE-2016-2781 was published on 2017-02-07. The supplied reference set points to discussion threads dated 2016-02-28, and the NVD record was later modified on 2026-05-13. No KEV listing is present in the supplied data.