Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by openin…

published 2011-03-30 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1112

cvss: 1.9; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.

Patch / fix

distros 3 links 4

debian red hat opensuse

logrotate Debian 14, Debian 13, Debian 12 3.8.0-1

debian advisories DEBIAN-CVE-2011-1098

logrotate RHEL 6 3.7.8-12.el6_0.1

red hat advisories RHSA-2011:0407

logrotate openSUSE Tumbleweed 3.10.0-4.1

opensuse advisories openSUSE-SU-2024:10231-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-1098 updated 2026-11-07 cvss 1.9

logrotate: TOCTOU race condition by creation of new files (between opening the file and moment, final permissions have been applied) [information disclosure]

Red Hat Enterprise Linux 4 logrotate Red Hat Enterprise Linux 5 logrotate
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux Desktop (v. 6) logrotate 3.7.8-12.el6_0.1 Red Hat Enterprise Linux HPC Node (v. 6) logrotate 3.7.8-12.el6_0.1 Red Hat Enterprise Linux Server (v. 6) logrotate 3.7.8-12.el6_0.1 Red Hat Enterprise Linux Workstation (v. 6) logrotate 3.7.8-12.el6_0.1
fixed: vendor fix RHSA-2011:0407

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	1.9	AV:L/AC:M/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

lists.fedoraproject.org /pipermail/package-announce/2011-March/056992.html
vendor-advisory, patch
openwall.com /lists/oss-security/2011/03/04/16
mailing-list, patch
openwall.com /lists/oss-security/2011/03/07/11
mailing-list, patch
bugzilla.redhat.com /show_bug.cgi?id=680798
patch
lists.fedoraproject.org /pipermail/package-announce/2011-April/057845.html
vendor-advisory
mandriva.com /security/advisories?name=MDVSA-2011:065
vendor-advisory
redhat.com /support/errata/RHSA-2011-0407.html
vendor-advisory
vupen.com /english/advisories/2011/0791
vdb-entry, vendor-advisory
openwall.com /lists/oss-security/2011/03/04/19
mailing-list
openwall.com /lists/oss-security/2011/03/04/25
mailing-list
openwall.com /lists/oss-security/2011/03/04/30
mailing-list
openwall.com /lists/oss-security/2011/03/04/26
mailing-list
openwall.com /lists/oss-security/2011/03/10/3
mailing-list
openwall.com /lists/oss-security/2011/03/04/28
mailing-list
openwall.com /lists/oss-security/2011/03/08/5
mailing-list
secunia.com /advisories/43955
third-party-advisory
openwall.com /lists/oss-security/2011/03/07/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/31
mailing-list
vupen.com /english/advisories/2011/0961
vdb-entry
openwall.com /lists/oss-security/2011/03/04/17
mailing-list
openwall.com /lists/oss-security/2011/03/10/6
mailing-list
openwall.com /lists/oss-security/2011/03/06/3
mailing-list
openwall.com /lists/oss-security/2011/03/04/29
mailing-list
openwall.com /lists/oss-security/2011/03/07/6
mailing-list
openwall.com /lists/oss-security/2011/03/05/6
mailing-list
openwall.com /lists/oss-security/2011/03/05/4
mailing-list
openwall.com /lists/oss-security/2011/03/23/11
mailing-list
openwall.com /lists/oss-security/2011/03/06/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/18
mailing-list
openwall.com /lists/oss-security/2011/03/10/2
mailing-list
openwall.com /lists/oss-security/2011/03/11/3
mailing-list
openwall.com /lists/oss-security/2011/03/10/7
mailing-list
openwall.com /lists/oss-security/2011/03/05/8
mailing-list
openwall.com /lists/oss-security/2011/03/04/22
mailing-list
openwall.com /lists/oss-security/2011/03/11/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/27
mailing-list
vupen.com /english/advisories/2011/0872
vdb-entry
openwall.com /lists/oss-security/2011/03/04/32
mailing-list
openwall.com /lists/oss-security/2011/03/14/26
mailing-list
openwall.com /lists/oss-security/2011/03/04/24
mailing-list
openwall.com /lists/oss-security/2011/03/04/33
openwall.com /lists/oss-security/2011/03/06/4
openwall.com /lists/oss-security/2011/03/06/6

Sources

CVE List CVE-2011-1098
NVD CVE-2011-1098

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary