{"id":"CVE-2016-2781","aliases":["AZL-34628","AZL-6355","DEBIAN-CVE-2016-2781","EUVD-2016-3855","GHSA-vf3q-65gx-324p","UBUNTU-CVE-2016-2781"],"status":"published","title":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent...","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00428,"percentile":0.37324,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-02-07T15:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"coreutils","fixed_in":["9.4-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"coreutils","fixed_in":["8.32-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"coreutils","fixed_in":["9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"coreutils","fixed_in":["9.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1-1","9.10-1","9.4-1","9.4-2","9.4-3","9.4-3.1","9.5-1","9.6-1","9.6-2","9.7-1","9.7-2","9.7-3"]},{"source":"osv","ecosystem":"Debian:13","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.20-3ubuntu5","8.21-1ubuntu3","8.21-1ubuntu4","8.21-1ubuntu5","8.21-1ubuntu5.1","8.21-1ubuntu5.3","8.21-1ubuntu5.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.23-4ubuntu2","8.25-2ubuntu2","8.25-2ubuntu3~16.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.26-3ubuntu4","8.28-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.30-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.32-4ubuntu2","8.32-4ubuntu3","8.32-4.1ubuntu1","8.32-4.1ubuntu1.1","8.32-4.1ubuntu1.2","8.32-4.1ubuntu1.3","8.32-4.1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1-1ubuntu2","9.4-2ubuntu1","9.4-2ubuntu2","9.4-2ubuntu3","9.4-2ubuntu4","9.4-3ubuntu3","9.4-3ubuntu5","9.4-3ubuntu6","9.4-3ubuntu6.1","9.4-3ubuntu6.2","9.4-3ubuntu6.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.5-1ubuntu1","9.5-1ubuntu1.25.10.1","9.5-1ubuntu2","9.5-1ubuntu3","9.5-1ubuntu4","9.5-1ubuntu4.1"]}],"products":[{"vendor":"gnu","product":"coreutils"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/02/28/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/02/28/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-vf3q-65gx-324p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2781","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2781","tags":["report"]},{"url":"http://seclists.org/oss-sec/2016/q1/452","tags":["report"]},{"url":"https://lore.kernel.org/patchwork/patch/793178/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2781","tags":["report"]},{"url":"https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.28/v2.28-ReleaseNotes","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-07T15:00:00Z","modified":"2025-06-09T15:59:40.434Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:33:33.424551Z"}],"euvd":[{"id":"EUVD-2016-3855","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-07T15:00:00Z","modified":"2025-06-09T15:59:40Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:27.753525Z"}],"ghsa":[{"id":"GHSA-vf3q-65gx-324p","title":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent...","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2022-05-13T01:11:38Z","modified":"2025-04-20T03:33:28Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:40.757238Z"}],"nvd":[{"id":"CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-07T15:59:00.333Z","modified":"2026-06-17T00:44:23.16Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"AZL-34628","title":"CVE-2016-2781 affecting package coreutils for versions less than 9.4-1","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-07T15:59:00Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"AZL-6355","title":"CVE-2016-2781 affecting package coreutils for versions less than 8.32-1","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-07T15:59:00Z","modified":"2026-04-21T04:32:10.486018Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-07T15:59:00.333Z","modified":"2026-03-14T09:19:10.204888Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-07T15:59:00.333Z","modified":"2026-09-22T07:01:56.931191308Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","status":"published","published":"2017-02-07T15:59:00Z","modified":"2026-08-31T17:15:56.29370505Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.872222Z"}]}}