LiveActive security incident?Get immediate response
CVE Record

CVE-2011-3632: Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to u...

Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE affects the hardlink utility before version 0.1.2. A local user could abuse how it handled full filesystem path names to perform symlink attacks. The sources do not provide CVSS scoring, confirmed impact details, or evidence of active exploitation.

Executive priority

Treat this as a targeted local-risk hygiene item, not an internet-scale emergency. Prioritize remediation on shared Linux systems, build hosts, and servers where untrusted users or jobs can influence filesystem content.

Technical view

hardlink before 0.1.2 used full filesystem object path names in a way that could allow local symlink attacks. The vulnerability is local, not remotely triggerable from the supplied evidence. Public references identify the flaw but provide limited detail on impact, scoring, and remediation beyond the fixed version boundary.

Likely exposure

Exposure is limited to systems with hardlink before 0.1.2 installed. Practical risk depends on whether local users can influence files or directories processed by hardlink, especially when it is run by privileged users or automation.

Exploitation context

The supplied bundle marks KEV as false and provides no cited evidence of active exploitation. The described attacker is local, so exploitation would require local access or another foothold before this issue becomes relevant.

Researcher notes

The record lacks CVSS, CWE, and detailed impact data. Analysis should stay bounded to local symlink-attack risk in hardlink before 0.1.2. Distro backports may affect version interpretation, so package advisory status matters.

Mitigation direction

  • Upgrade hardlink to version 0.1.2 or later where available.
  • Check Debian and Red Hat guidance for package-specific remediation status.
  • Avoid running vulnerable hardlink builds on attacker-writable paths.
  • Restrict local shell access where hardlink is still vulnerable.
  • Review automation that invokes hardlink with elevated privileges.

Validation and detection

  • Inventory installed hardlink versions across Linux systems.
  • Confirm no deployed package reports a version before 0.1.2.
  • Check distro advisories for backported fixes with unchanged upstream versions.
  • Review cron jobs or scripts that invoke hardlink.
  • Verify hardlink is not run against untrusted writable directories.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2011-3632 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
hardlinkhardlinkbefore 0.1.2Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.