CVE-2011-0460 in openSUSE
Summary
by MITRE
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/11/2026
The vulnerability identified as CVE-2011-0460 resides within the init script of the kbd package, specifically affecting versions 1.14.1 and earlier. This issue represents a classic symlink attack scenario that exploits insecure temporary file handling practices. The flaw manifests when the init script attempts to create or modify files in the /dev/shm/ directory, which is a temporary filesystem typically mounted as a tmpfs. The vulnerability stems from the script's failure to properly validate file paths or implement secure temporary file creation mechanisms, creating an opportunity for local attackers to manipulate the system's keyboard mapping initialization process.
The technical exploitation of this vulnerability occurs through a race condition or symlink manipulation attack. An attacker with local access can create a symbolic link at /dev/shm/defkeymap.map that points to a target file of their choice, such as a system configuration file or a file in a privileged directory. When the init script executes and attempts to write to this location, it inadvertently overwrites the target file that the symbolic link references. This creates a privilege escalation vector or allows for arbitrary file modification, depending on the target file's permissions and location within the filesystem. The vulnerability is classified as a symlink race condition, which is categorized under CWE-367 and represents a common weakness in Unix-like systems where temporary files are created without proper security checks.
The operational impact of this vulnerability extends beyond simple file overwriting, as it can potentially enable attackers to modify critical system configuration files or inject malicious content into the keyboard mapping initialization process. This could lead to persistent backdoors, privilege escalation to root-level access, or disruption of normal system operations. Attackers could leverage this vulnerability to modify system files that control keyboard behavior, potentially creating long-term access points or disrupting legitimate user sessions. The attack requires local system access but does not need network connectivity, making it particularly concerning for environments where physical access is possible or where users might be tricked into executing malicious scripts. This vulnerability aligns with ATT&CK technique T1068, which involves exploiting local system privileges to escalate access.
Mitigation strategies for CVE-2011-0460 focus on implementing secure temporary file creation practices and addressing the underlying symlink attack vectors. The most effective approach involves updating to a patched version of the kbd package where the init script properly validates file paths or uses secure temporary file creation methods such as mkstemp() instead of creating files with predictable names in world-writable directories. System administrators should also implement proper file permissions and ownership checks on critical system directories, particularly /dev/shm, and monitor for unauthorized symbolic link creation in these areas. Additionally, the principle of least privilege should be enforced by ensuring that init scripts run with minimal required permissions and that temporary files are created with restrictive permissions that prevent unauthorized access or modification. Organizations should conduct regular security audits to identify and remediate similar vulnerabilities in other system initialization scripts and temporary file handling mechanisms, as this class of vulnerability has been historically prevalent in Unix-like systems and continues to represent a significant security risk.