Every CVESearch/Get API key

CVE-2011-1011

The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of...

6.9 MediumFix available

CVE-2011-1011 is a medium vulnerability (CVSS 6.9) in Redhat Enterprise Linux, published February 24, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in selinux-policy 0:3.7.19-54.el6_0.5.

Severity
6.9 MediumCVSS 2.0, NVD
Exploit chance
0.37%EPSS, 31st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0:3.7.19-54.el6_0.5selinux-policy +43 more

Description

The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.

Exploit likelihood

0.37%Down 1.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
selinux-policy
Red Hat:enterprise_linux:6::client
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-doc
Red Hat:enterprise_linux:6::client
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
policycoreutils
Red Hat:enterprise_linux:6::client
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-debuginfo
Red Hat:enterprise_linux:6::client
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-gui
Red Hat:enterprise_linux:6::client
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-newrole
Red Hat:enterprise_linux:6::client
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-python
Red Hat:enterprise_linux:6::client
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-sandbox
Red Hat:enterprise_linux:6::client
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
selinux-policy-minimum
Red Hat:enterprise_linux:6::client
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-mls
Red Hat:enterprise_linux:6::client
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
Show 34 moreShow less
Affected packages
PackageAffectedFixed
selinux-policy-targeted
Red Hat:enterprise_linux:6::client
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
policycoreutils
Red Hat:enterprise_linux:6::computenode
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-debuginfo
Red Hat:enterprise_linux:6::computenode
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-gui
Red Hat:enterprise_linux:6::computenode
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-sandbox
Red Hat:enterprise_linux:6::computenode
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
selinux-policy
Red Hat:enterprise_linux:6::computenode
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-doc
Red Hat:enterprise_linux:6::computenode
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
policycoreutils-newrole
Red Hat:enterprise_linux:6::computenode
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-python
Red Hat:enterprise_linux:6::computenode
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
selinux-policy-minimum
Red Hat:enterprise_linux:6::computenode
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-mls
Red Hat:enterprise_linux:6::computenode
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-targeted
Red Hat:enterprise_linux:6::computenode
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy
Red Hat:enterprise_linux:6::server
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-doc
Red Hat:enterprise_linux:6::server
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
policycoreutils
Red Hat:enterprise_linux:6::server
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-debuginfo
Red Hat:enterprise_linux:6::server
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-gui
Red Hat:enterprise_linux:6::server
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-newrole
Red Hat:enterprise_linux:6::server
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-python
Red Hat:enterprise_linux:6::server
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-sandbox
Red Hat:enterprise_linux:6::server
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
selinux-policy-minimum
Red Hat:enterprise_linux:6::server
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-mls
Red Hat:enterprise_linux:6::server
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-targeted
Red Hat:enterprise_linux:6::server
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy
Red Hat:enterprise_linux:6::workstation
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-doc
Red Hat:enterprise_linux:6::workstation
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
policycoreutils
Red Hat:enterprise_linux:6::workstation
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-debuginfo
Red Hat:enterprise_linux:6::workstation
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-gui
Red Hat:enterprise_linux:6::workstation
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-newrole
Red Hat:enterprise_linux:6::workstation
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-python
Red Hat:enterprise_linux:6::workstation
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
policycoreutils-sandbox
Red Hat:enterprise_linux:6::workstation
before 0:2.0.83-19.8.el6_0
0:2.0.83-19.8.el6_0
selinux-policy-minimum
Red Hat:enterprise_linux:6::workstation
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-mls
Red Hat:enterprise_linux:6::workstation
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5
selinux-policy-targeted
Red Hat:enterprise_linux:6::workstation
before 0:3.7.19-54.el6_0.5
0:3.7.19-54.el6_0.5

What each source reports

NVD Score used6.9

The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.

Record
CVE-2011-1011
CVSS 2.0
6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE ListNo score

The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.

Record
CVE-2011-1011
Updated
2026-11-02
EUVDEUVD-2011-1028No score

The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.

Record
EUVD-2011-1028
Updated
2026-11-03
GitHub AdvisoriesGHSA-7fgm-8fq2-6xv7No score

The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of...

The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.

Record
GHSA-7fgm-8fq2-6xv7
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 17 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open