CVE-2011-1784: The pidfile_write function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the...

Security readout for executives and security teams

Keepalived 1.2.2 and earlier created several runtime PID files as world-writable. A local user on the same system could change those files so keepalived-related control logic kills the wrong process, potentially disrupting availability of services on a load balancer or HA node. Exposure is most likely on legacy Linux systems running keepalived 1.2.2 or earlier, especially shared systems where untrusted local users have shell or application-level access. Public internet exposure is not indicated because the vulnerability requires local file write access. Treat this as a legacy hygiene and availability risk. It is not described as remotely exploitable, but affected HA infrastructure can be business-critical. Prioritize systems with local multi-user access or production traffic-routing roles. Mitigation focus: Identify and upgrade keepalived 1.2.2 or earlier through vendor-supported packages.; Check Debian, Red Hat, or relevant distribution advisories for the fixed package guidance.; Ensure keepalived runtime PID files are not world-writable after remediation..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.