It was reported, that hardlink, the tool for consolidation of duplicate files via hardlinks operated on full file system objects path names. A local attacker could use this flaw to conduct symlink attacks (cause the hardlink executable to operate on directories / files outside of the intended directory tree).
Proposed patch (applied by the Owl Linux distribution):
[Adds section BUGS into the hardlink(1) man page documenting the danger]
This issue affect the versions of the hardlink package, as shipped with Fedora release of 14 and 15. Please schedule an update.
Created hardlink tracking bugs for this issue
Affects: fedora-all [bug 746715]
This issue affect the versions of the hardlink package, as shipped with
Red Hat Enterprise Linux 5 and 6.
The CVE identifier of CVE-2011-3632 has been assigned to this issue:
hardlink-1.0-12.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
hardlink-1.0-12.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.