CVE-2011-1022 The cgre_receive_netlink_msg function in daemon/cgrulesengd.c in cgrulesengd in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 does not verify that netlink messages ori...
LowCVSS 2.1
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The cgre_receive_netlink_msg function in daemon/cgrulesengd.c in cgrulesengd in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 does not verify that netlink messages originated in the kernel, which allows local users to bypass intended resource restrictions via a crafted message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| balbir singh libcgroup | <= 0.37 | No fix listed |
| balbir singh libcgroup | = 0.1b | No fix listed |
| balbir singh libcgroup | = 0.1c | No fix listed |
| balbir singh libcgroup | = 0.2 | No fix listed |
| balbir singh libcgroup | = 0.3 | No fix listed |
| balbir singh libcgroup | = 0.31 | No fix listed |
| balbir singh libcgroup | = 0.32 | No fix listed |
| balbir singh libcgroup | = 0.32.1 | No fix listed |
| balbir singh libcgroup | = 0.32.2 | No fix listed |
| balbir singh libcgroup | = 0.33 | No fix listed |
| balbir singh libcgroup | = 0.34 | No fix listed |
| balbir singh libcgroup | = 0.35 | No fix listed |
| balbir singh libcgroup | = 0.35.1 | No fix listed |
| balbir singh libcgroup | = 0.36 | No fix listed |
| balbir singh libcgroup | = 0.36.1 | No fix listed |
| balbir singh libcgroup | = 0.36.2 | No fix listed |
| balbir singh libcgroup | = 0.37-rc1 | No fix listed |
| debian/libcgroup(Debian:12) | < 0.37.1-1 | 0.37.1-1 |
| debian/libcgroup(Debian:13) | < 0.37.1-1 | 0.37.1-1 |
| debian/libcgroup(Debian:14) | < 0.37.1-1 | 0.37.1-1 |
References
- bugs.debian.org patch
- FEDORA-2011-2631 vendor-advisory
- FEDORA-2011-2638 vendor-advisory
- openSUSE-SU-2011:0316 vendor-advisory
- [oss-security] 20110225 Re: CVE request: libcgroup: Failure to verify netlink messages mailing-list patch
- [oss-security] 20110225 Re: CVE request: libcgroup: Failure to verify netlink messages mailing-list patch
- [oss-security] 20110225 Re: CVE request: libcgroup: Failure to verify netlink messages mailing-list
- [oss-security] 20110224 CVE request: libcgroup: Failure to verify netlink messages mailing-list patch
- [oss-security] 20110225 Re: CVE request: libcgroup: Failure to verify netlink messages mailing-list patch
- 43611 third-party-advisory vendor-advisory
- 43758 third-party-advisory vendor-advisory
- 43891 third-party-advisory
- 44093 third-party-advisory
- [libcg-devel] 20101115 Fwd: libcgroup netlink mailing-list patch
- [libcg-devel] 20110218 [PATCH 2/2] cgrulesengd: Ignore netlink messages that don't come from the kernel. mailing-list patch
- sourceforge.net patch
- DSA-2193 vendor-advisory
- RHSA-2011:0320 vendor-advisory
- 46578 vdb-entry
- 1025157 vdb-entry
- ADV-2011-0679 vdb-entry vendor-advisory
- ADV-2011-0774 vdb-entry
- bugzilla.redhat.com patch
- Debian Security Tracker CVE-2011-1022 vendor-advisory
- bugs.debian.org issue-tracking