CVE-2011-1089

glibc: Suid mount helpers fail to anticipate RLIMIT_FSIZE

Severity Score

9.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file, as demonstrated by writes from a process with a small RLIMIT_FSIZE value, a different vulnerability than CVE-2010-0296.

La función addmntent en la biblioteca C de GNU (también conocida como glibc o libc6) v2.13 y anteriores no informa de un estado de error de intentos fallidos al escribir en el fichero /etc/mtab, haciendo más fácil para los usuarios locales provocar la corrupción de este archivo, como lo demuestra escribiendo desde un proceso con un valor RLIMIT_FSIZE pequeño, una vulnerabilidad diferente de CVE-2010-0296.

Multiple vulnerabilities have been found in GNU C Library, the worst of which allowing arbitrary code execution and privilege escalation. Versions less than 2.15-r3 are affected.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-02-24 CVE Reserved
2011-04-10 CVE Published
2024-08-06 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-16: Configuration

CAPEC

References (23)

URL	Tag	Source
http://openwall.com/lists/oss-security/2011/03/04/10	Mailing List
http://openwall.com/lists/oss-security/2011/03/04/11	Mailing List
http://openwall.com/lists/oss-security/2011/03/04/12	Mailing List
http://openwall.com/lists/oss-security/2011/03/04/9	Mailing List
http://openwall.com/lists/oss-security/2011/03/05/3	Mailing List
http://openwall.com/lists/oss-security/2011/03/05/7	Mailing List
http://openwall.com/lists/oss-security/2011/03/07/9	Mailing List
http://openwall.com/lists/oss-security/2011/03/14/16	Mailing List
http://openwall.com/lists/oss-security/2011/03/14/5	Mailing List
http://openwall.com/lists/oss-security/2011/03/14/7	Mailing List
http://openwall.com/lists/oss-security/2011/03/15/6	Mailing List
http://openwall.com/lists/oss-security/2011/03/22/4	Mailing List
http://openwall.com/lists/oss-security/2011/03/22/6	Mailing List
http://openwall.com/lists/oss-security/2011/03/31/3	Mailing List
http://openwall.com/lists/oss-security/2011/03/31/4	Mailing List
http://openwall.com/lists/oss-security/2011/04/01/2	Mailing List
http://sourceware.org/bugzilla/show_bug.cgi?id=12625	Issue Tracking
http://www.securityfocus.com/bid/46740	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://www.mandriva.com/security/advisories?name=MDVSA-2011:178	2016-12-07
http://www.mandriva.com/security/advisories?name=MDVSA-2011:179	2016-12-07
http://www.redhat.com/support/errata/RHSA-2011-1526.html	2016-12-07
https://bugzilla.redhat.com/show_bug.cgi?id=688980	2012-02-13
https://access.redhat.com/security/cve/CVE-2011-1089	2012-02-13

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				<= 2.13 Search vendor "Gnu" for product "Glibc" and version " <= 2.13"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.00 Search vendor "Gnu" for product "Glibc" and version "1.00"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.01 Search vendor "Gnu" for product "Glibc" and version "1.01"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.02 Search vendor "Gnu" for product "Glibc" and version "1.02"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.03 Search vendor "Gnu" for product "Glibc" and version "1.03"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.04 Search vendor "Gnu" for product "Glibc" and version "1.04"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.05 Search vendor "Gnu" for product "Glibc" and version "1.05"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.06 Search vendor "Gnu" for product "Glibc" and version "1.06"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.07 Search vendor "Gnu" for product "Glibc" and version "1.07"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.08 Search vendor "Gnu" for product "Glibc" and version "1.08"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.09 Search vendor "Gnu" for product "Glibc" and version "1.09"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.09.1 Search vendor "Gnu" for product "Glibc" and version "1.09.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.0 Search vendor "Gnu" for product "Glibc" and version "2.0"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.0.1 Search vendor "Gnu" for product "Glibc" and version "2.0.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.0.2 Search vendor "Gnu" for product "Glibc" and version "2.0.2"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.0.3 Search vendor "Gnu" for product "Glibc" and version "2.0.3"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.0.4 Search vendor "Gnu" for product "Glibc" and version "2.0.4"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.0.5 Search vendor "Gnu" for product "Glibc" and version "2.0.5"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.0.6 Search vendor "Gnu" for product "Glibc" and version "2.0.6"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1 Search vendor "Gnu" for product "Glibc" and version "2.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.1 Search vendor "Gnu" for product "Glibc" and version "2.1.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.1.6 Search vendor "Gnu" for product "Glibc" and version "2.1.1.6"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.2 Search vendor "Gnu" for product "Glibc" and version "2.1.2"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.3 Search vendor "Gnu" for product "Glibc" and version "2.1.3"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.3.10 Search vendor "Gnu" for product "Glibc" and version "2.1.3.10"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.9 Search vendor "Gnu" for product "Glibc" and version "2.1.9"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.2 Search vendor "Gnu" for product "Glibc" and version "2.2"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.2.1 Search vendor "Gnu" for product "Glibc" and version "2.2.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.2.2 Search vendor "Gnu" for product "Glibc" and version "2.2.2"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.2.3 Search vendor "Gnu" for product "Glibc" and version "2.2.3"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.2.4 Search vendor "Gnu" for product "Glibc" and version "2.2.4"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.2.5 Search vendor "Gnu" for product "Glibc" and version "2.2.5"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.3 Search vendor "Gnu" for product "Glibc" and version "2.3"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.3.1 Search vendor "Gnu" for product "Glibc" and version "2.3.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.3.2 Search vendor "Gnu" for product "Glibc" and version "2.3.2"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.3.3 Search vendor "Gnu" for product "Glibc" and version "2.3.3"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.3.4 Search vendor "Gnu" for product "Glibc" and version "2.3.4"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.3.5 Search vendor "Gnu" for product "Glibc" and version "2.3.5"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.3.6 Search vendor "Gnu" for product "Glibc" and version "2.3.6"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.3.10 Search vendor "Gnu" for product "Glibc" and version "2.3.10"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.4 Search vendor "Gnu" for product "Glibc" and version "2.4"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.5 Search vendor "Gnu" for product "Glibc" and version "2.5"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.5.1 Search vendor "Gnu" for product "Glibc" and version "2.5.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.6 Search vendor "Gnu" for product "Glibc" and version "2.6"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.6.1 Search vendor "Gnu" for product "Glibc" and version "2.6.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.7 Search vendor "Gnu" for product "Glibc" and version "2.7"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.8 Search vendor "Gnu" for product "Glibc" and version "2.8"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.9 Search vendor "Gnu" for product "Glibc" and version "2.9"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.10 Search vendor "Gnu" for product "Glibc" and version "2.10"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.10.1 Search vendor "Gnu" for product "Glibc" and version "2.10.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.10.2 Search vendor "Gnu" for product "Glibc" and version "2.10.2"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.11 Search vendor "Gnu" for product "Glibc" and version "2.11"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.11.1 Search vendor "Gnu" for product "Glibc" and version "2.11.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.11.2 Search vendor "Gnu" for product "Glibc" and version "2.11.2"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.11.3 Search vendor "Gnu" for product "Glibc" and version "2.11.3"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.12.0 Search vendor "Gnu" for product "Glibc" and version "2.12.0"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.12.1 Search vendor "Gnu" for product "Glibc" and version "2.12.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.12.2 Search vendor "Gnu" for product "Glibc" and version "2.12.2"		-		Affected