CVE-2011-1011
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of...
CVE-2011-1011 is a medium vulnerability (CVSS 6.9) in Redhat Enterprise Linux, published February 24, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in selinux-policy 0:3.7.19-54.el6_0.5.
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.
Exploit likelihood
What each source reports
NVD Score used
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.
- Record
CVE-2011-1011- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.
- Record
CVE-2011-1011- Updated
- 2026-11-02
EUVDEUVD-2011-1028 No score
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.
- Record
EUVD-2011-1028- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7fgm-8fq2-6xv7 No score
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of...
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.
- Record
GHSA-7fgm-8fq2-6xv7- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
selinux-policyRed Hat:enterprise_linux:6::client |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-docRed Hat:enterprise_linux:6::client |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
policycoreutilsRed Hat:enterprise_linux:6::client |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-debuginfoRed Hat:enterprise_linux:6::client |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-guiRed Hat:enterprise_linux:6::client |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-newroleRed Hat:enterprise_linux:6::client |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-pythonRed Hat:enterprise_linux:6::client |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-sandboxRed Hat:enterprise_linux:6::client |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
selinux-policy-minimumRed Hat:enterprise_linux:6::client |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-mlsRed Hat:enterprise_linux:6::client |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
selinux-policy-targetedRed Hat:enterprise_linux:6::client |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
policycoreutilsRed Hat:enterprise_linux:6::computenode |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-guiRed Hat:enterprise_linux:6::computenode |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-sandboxRed Hat:enterprise_linux:6::computenode |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
selinux-policyRed Hat:enterprise_linux:6::computenode |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-docRed Hat:enterprise_linux:6::computenode |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
policycoreutils-newroleRed Hat:enterprise_linux:6::computenode |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-pythonRed Hat:enterprise_linux:6::computenode |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
selinux-policy-minimumRed Hat:enterprise_linux:6::computenode |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-mlsRed Hat:enterprise_linux:6::computenode |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-targetedRed Hat:enterprise_linux:6::computenode |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policyRed Hat:enterprise_linux:6::server |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-docRed Hat:enterprise_linux:6::server |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
policycoreutilsRed Hat:enterprise_linux:6::server |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-debuginfoRed Hat:enterprise_linux:6::server |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-guiRed Hat:enterprise_linux:6::server |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-newroleRed Hat:enterprise_linux:6::server |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-pythonRed Hat:enterprise_linux:6::server |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-sandboxRed Hat:enterprise_linux:6::server |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
selinux-policy-minimumRed Hat:enterprise_linux:6::server |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-mlsRed Hat:enterprise_linux:6::server |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-targetedRed Hat:enterprise_linux:6::server |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policyRed Hat:enterprise_linux:6::workstation |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-docRed Hat:enterprise_linux:6::workstation |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
policycoreutilsRed Hat:enterprise_linux:6::workstation |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-guiRed Hat:enterprise_linux:6::workstation |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-newroleRed Hat:enterprise_linux:6::workstation |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-pythonRed Hat:enterprise_linux:6::workstation |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
policycoreutils-sandboxRed Hat:enterprise_linux:6::workstation |
before 0:2.0.83-19.8.el6_0 | 0:2.0.83-19.8.el6_0 |
selinux-policy-minimumRed Hat:enterprise_linux:6::workstation |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-mlsRed Hat:enterprise_linux:6::workstation |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
selinux-policy-targetedRed Hat:enterprise_linux:6::workstation |
before 0:3.7.19-54.el6_0.5 | 0:3.7.19-54.el6_0.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=633544
secunia.com/advisories/44034
archives.neohapsis.com/archives/fulldisclosure/2011-02/0585.html
securitytracker.com/id?1025291
pkgs.fedoraproject.org/gitweb?p=policycoreutils.git%3Ba=blob%3Bf=policycoreutils-rhat.patch%3Bh=d4db5bc06027de23d12a4b3f18fa6f9b1517df27%3Bhb=HEAD
exchange.xforce.ibmcloud.com/vulnerabilities/65641
Show 17 moreShow less
vupen.com/english/advisories/2011/0701
lists.fedoraproject.org/pipermail/package-announce/2011-March/056227.html
redhat.com/support/errata/RHSA-2011-0414.html
securityfocus.com/bid/46510
openwall.com/lists/oss-security/2011/02/23/1
nvd.nist.gov/vuln/detail/CVE-2011-1011
github.com/advisories/GHSA-7fgm-8fq2-6xv7
access.redhat.com/errata/RHSA-2011:0414
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0414.json
cve.org/CVERecord?id=CVE-2011-1011