CVE-2011-2921: ktsuss fails to drop root privileges before running user commands

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityIt is a setuid-root privilege escalation with public exploit code and very high EPSS, but it is not in KEV and the affected product is a niche utility.

What it is

ktsuss versions 1.4 and prior run with the uid set to root and do not drop privileges before executing user-specified commands. This lets a caller run arbitrary commands as root, which is a full local privilege escalation on any host where the setuid binary is installed. The record gives no fixed version, so affected builds must be identified from the vendor or distribution tracker.

Impact

An attacker gains arbitrary command execution with root privileges, leading to complete compromise of confidentiality, integrity and availability on the affected host.

Attack surface

The flaw is in a setuid-root helper that executes user-supplied commands, so it is reached by invoking the ktsuss binary on a local system. The CVSS vector (AV:N/PR:N/UI:N) scores it as network-reachable with no authentication or user interaction, but the description indicates a local privilege escalation, and the record does not reconcile the two.

Exploitation

CISA KEV does not list it, but EPSS is very high (0.831, 99.7th percentile) and a public Packet Storm exploit reference exists, so working exploit code is publicly available.

What to do

• Patch or upgrade ktsuss past version 1.4, or remove the setuid bit and uninstall the package if no fixed release is available.
• Check distribution security trackers (Debian, Red Hat) for the fixed package version and apply it.
• Restrict execution of the ktsuss binary to trusted users and audit setuid-root binaries on hosts.
• Monitor or block use of ktsuss where it is not operationally required.

Detection

• Audit hosts for installed ktsuss binaries and confirm their setuid-root permissions.
• Alert on ktsuss process execution, especially spawning shells or commands as root.
• Monitor for child processes of ktsuss running with uid 0 outside expected administrative workflows.
• Review process accounting or EDR logs for privilege escalation via setuid helpers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.