CVE-2011-2473: The do_dump_data function in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to creat...

Security readout for executives and security teams

CVE-2011-2473 is an old local vulnerability in OProfile. A local user could potentially cause OProfile to create or overwrite files through unsafe handling of a session directory and pipe file. Business risk is mainly on Linux systems where OProfile is installed and usable by non-root users or via sudo. Exposure is likely limited to older Linux systems with vulnerable OProfile packages installed, especially where local users can invoke opcontrol directly or through sudo. Systems without OProfile, without local untrusted users, or with updated packages are less likely exposed. Treat this as a legacy local privilege-risk item. It is not internet-facing based on the provided sources, but it can matter on shared servers, build hosts, appliances, or old Linux estates where local users have sudo-controlled tooling. Mitigation focus: Inventory systems for OProfile 0.9.6 or earlier.; Apply vendor security updates, including Debian DSA-2254 where applicable.; Restrict sudo or local access to opcontrol until patched..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.