{"id":"CVE-2011-3151","aliases":["EUVD-2011-3118","GHSA-3wp7-vqr4-g72h"],"status":"published","title":"SELinux initscript misuse of touch","description":"The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not have symlink protections then an attacker can cause a zero byte file to be allocated on any writable filesystem.","severity":{"version":"3.0","score":5.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00601,"percentile":0.49056,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-693"],"published":"2019-04-22T15:35:58Z","modified":"2026-06-16T23:32:45Z","products":[{"vendor":"canonical","product":"selinux"}],"references":[{"url":"https://launchpadlibrarian.net/88098106/selinux_0.10~10.04.1.debdiff","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3151"},{"url":"https://github.com/advisories/GHSA-3wp7-vqr4-g72h"}],"sources":{"cve":[{"id":"CVE-2011-3151","title":"SELinux initscript misuse of touch","description":"The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not have symlink protections then an attacker can cause a zero byte file to be allocated on any writable filesystem.","status":"published","published":"2019-04-22T15:35:58.934Z","modified":"2024-09-16T22:26:42.178Z","cvss":[{"version":"3.0","score":5.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:36.968002Z"}],"euvd":[{"id":"EUVD-2011-3118","description":"The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not have symlink protections then an attacker can cause a zero byte file to be allocated on any writable filesystem.","status":"published","published":"2019-04-22T15:35:58Z","modified":"2024-09-16T22:26:42Z","cvss":[{"version":"3.0","score":5.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:02.946444Z"}],"ghsa":[{"id":"GHSA-3wp7-vqr4-g72h","title":"The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world...","description":"The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not have symlink protections then an attacker can cause a zero byte file to be allocated on any writable filesystem.","status":"published","published":"2022-04-22T00:24:07Z","modified":"2024-04-03T23:04:33Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:55:46.758976Z"}],"nvd":[{"id":"CVE-2011-3151","description":"The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not have symlink protections then an attacker can cause a zero byte file to be allocated on any writable filesystem.","status":"published","published":"2019-04-22T16:29:00.397Z","modified":"2026-06-16T23:32:45.62Z","cvss":[{"version":"3.0","score":5.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:02:12.945371Z"}]}}