CVE-2011-3151: SELinux initscript misuse of touch
The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not have symlink protections then an attacker can cause a zero byte file to be allocated on any writable filesystem.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3151?
CVE-2011-3151 is considered a moderate severity vulnerability due to its potential for exploitation in a world-writable directory.
How do I fix CVE-2011-3151?
To fix CVE-2011-3151, upgrade the SELinux initscript to version 1:0.10 or later.
What systems are affected by CVE-2011-3151?
CVE-2011-3151 affects Ubuntu systems running SELinux initscript versions prior to 1:0.10.
What is the impact of CVE-2011-3151?
The impact of CVE-2011-3151 allows an attacker to create a zero byte file on any writable filesystem if symlink protections are not enabled.
Can CVE-2011-3151 be exploited remotely?
CVE-2011-3151 generally requires local access to the system to exploit, as it involves manipulation of directories and files.