CVE-2011-1784 in keepalived
Summary
by MITRE
The pidfile_write function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the (1) keepalived.pid, (2) checkers.pid, and (3) vrrp.pid files in /var/run/, which allows local users to kill arbitrary processes by writing a PID to one of these files.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/07/2021
The vulnerability described in CVE-2011-1784 resides within the keepalived service daemon version 1.2.2 and earlier, specifically within the pidfile_write function located in core/pidfile.c. This flaw represents a critical security issue that stems from improper permission handling for process identifier files that keepalived creates during operation. The affected files include keepalived.pid, checkers.pid, and vrrp.pid which are all stored in the /var/run/ directory, a location commonly used for runtime data and process information on Unix-like systems.
The technical flaw manifests through the use of overly permissive 0666 permissions for these PID files, which grants read and write access to all users on the system. This permission scheme violates fundamental security principles by allowing any local user to modify these critical files. When a local attacker writes a process identifier to one of these PID files, they effectively gain the ability to manipulate the keepalived service's behavior, potentially enabling them to kill arbitrary processes running on the system. This represents a privilege escalation vulnerability that can be exploited to disrupt system services or gain unauthorized control over critical network functions.
The operational impact of this vulnerability extends beyond simple process termination, as keepalived is commonly used for high availability configurations including virtual router redundancy protocol vrrp implementations. Attackers could potentially disrupt network failover mechanisms, compromise load balancing operations, or cause service interruptions that could affect availability. The vulnerability affects systems where keepalived is running with elevated privileges, making it particularly dangerous as it could allow attackers to target critical system processes or services that depend on keepalived for proper operation. This flaw aligns with CWE-732: Incorrect Permission Assignment for Critical Resource, which specifically addresses inadequate permissions for system-critical files.
From an attack perspective, this vulnerability maps to multiple ATT&CK techniques including privilege escalation through file permissions manipulation and service stop/start operations. The attack vector requires local system access, but the impact can be significant for network infrastructure services that rely on keepalived for maintaining service availability. The vulnerability can be exploited by any local user without requiring special privileges, making it particularly concerning in multi-user environments where users may not be trusted. This represents a classic case of insufficient access control that allows unauthorized modification of system-critical runtime files.
Mitigation strategies for CVE-2011-1784 should include immediate patching of keepalived to version 1.2.3 or later, where the permission handling has been corrected to use more restrictive permissions for the PID files. System administrators should also implement proper file permission monitoring to detect unauthorized changes to critical system files. Additionally, the principle of least privilege should be enforced by ensuring that keepalived runs with minimal required privileges and that the PID files are created with appropriate permissions such as 0644 or 0600 to prevent unauthorized modification. Network segmentation and monitoring solutions should be implemented to detect suspicious activities related to process manipulation or service disruption attempts.