CVE-2011-1784 Privilege escalation in n/a

Low 3.6 Published 20 May 2011 Updated 6 Aug 2024

Local attackers can kill arbitrary processes by writing PIDs to world-writable keepalived PID files, leading to privilege escalation or denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2011-1784?

CVE-2011-1784 is a low-severity vulnerability in n/a, published on 20 May 2011. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The pidfile_write function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the (1) keepalived.pid, (2) checkers.pid, and (3) vrrp.pid files in /var/run/, which allows local users to kill arbitrary processes by writing a PID to one of these files.

Weakness: CWE-264

Which versions are affected by CVE-2011-1784?

It affects 1 product.

Products include Keepalived Keepalived.

How do I fix CVE-2011-1784?

Upgrade to a fixed version.

Is CVE-2011-1784 being exploited?

There is no known exploitation of CVE-2011-1784 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2011-1784, GHSA-xjrv-p75r-gqqr.