The cgre_receive_netlink_msg function in daemon/cgrulesengd.c in cgrulesengd in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 does not verify that netlink messages originated in the kernel, which allows local users to bypass intended resource restrictions via a crafted message.

Two security bugfixes in libcgroup1 were done :

libcgroup suffered from a heap based buffer overflow (CVE-2011-1006).

The cgrulesengd daemon did not verify the origin of netlink messages, allowing local users to spoof events (CVE-2011-1022).

libcgroup suffered from a heap based buffer overflow (CVE-2011-1006).

The cgrulesengd daemon did not verify the origin of netlink messages, allowing local users to spoof events (CVE-2011-1022).

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0320 advisory.

    [0.36-6.1]
    - Fixed buffer overflow when parsing cgexec command line parameters.
    - Added checking of source of netlink messages to cgrulesengd daemon.
    - Resolves: CVE-2011-1006 CVE-2011-1022

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the way libcgroup converted a list of user-provided controllers for a particular task into an array of strings. A local attacker could use this flaw to escalate their privileges via a specially crafted list of controllers.
(CVE-2011-1006)

It was discovered that libcgroup did not properly check the origin of Netlink messages. A local attacker could use this flaw to send crafted Netlink messages to the cgrulesengd daemon, causing it to put processes into one or more existing control groups, based on the attacker's choosing, possibly allowing the particular tasks to run with more resources (memory, CPU, etc.) than originally intended.
(CVE-2011-1022)

Two security bugs were fixed in this release :

  - CVE-2011-1006: Heap-based buffer overflow by converting     list of controllers for given task into an array of     strings

  - CVE-2011-1022: Unchecked origin of NETLINK messages

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following bugs have been fixed :

  - libcgroup suffered from a heap-based buffer overflow.
    (CVE-2011-1006)

  - The cgrulesengd daemon did not verify the origin of     netlink messages, allowing local users to spoof events.
    (CVE-2011-1022)

Several issues have been discovered in libcgroup, a library to control and monitor control groups :

  - CVE-2011-1006     Heap-based buffer overflow by converting list of     controllers for given task into an array of strings     could lead to privilege escalation by a local attacker.

  - CVE-2011-1022     libcgroup did not properly check the origin of Netlink     messages, allowing a local attacker to send crafted     Netlink messages which could lead to privilege     escalation.

The oldstable distribution (lenny) does not contain libcgroup packages.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0320 advisory.

    The libcgroup packages provide tools and libraries to control and monitor     control groups.

    A heap-based buffer overflow flaw was found in the way libcgroup converted     a list of user-provided controllers for a particular task into an array of     strings. A local attacker could use this flaw to escalate their privileges     via a specially-crafted list of controllers. (CVE-2011-1006)

    It was discovered that libcgroup did not properly check the origin of     Netlink messages. A local attacker could use this flaw to send crafted     Netlink messages to the cgrulesengd daemon, causing it to put processes     into one or more existing control groups, based on the attacker's choosing,     possibly allowing the particular tasks to run with more resources (memory,     CPU, etc.) than originally intended. (CVE-2011-1022)

    Red Hat would like to thank Nelson Elhage for reporting the CVE-2011-1006     issue.

    All libcgroup users should upgrade to these updated packages, which contain     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
75893	openSUSE Security Update : libcgroup-devel (openSUSE-SU-2011:0316-1)	Nessus	SuSE Local Security Checks	high
75572	openSUSE Security Update : libcgroup-devel (openSUSE-SU-2011:0316-1)	Nessus	SuSE Local Security Checks	high
68218	Oracle Linux 6 : libcgroup (ELSA-2011-0320)	Nessus	Oracle Linux Local Security Checks	high
60979	Scientific Linux Security Update : libcgroup on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
54834	Fedora 13 : libcgroup-0.35.1-5.fc13 (2011-2570)	Nessus	Fedora Local Security Checks	high
53746	openSUSE Security Update : libcgroup-devel (openSUSE-SU-2011:0316-1)	Nessus	SuSE Local Security Checks	high
53358	SuSE 11.1 Security Update : libcgroup (SAT Patch Number 4081)	Nessus	SuSE Local Security Checks	high
52982	Fedora 15 : libcgroup-0.37.1-1.fc15 (2011-2638)	Nessus	Fedora Local Security Checks	high
52981	Fedora 14 : libcgroup-0.36.2-6.fc14 (2011-2631)	Nessus	Fedora Local Security Checks	high
52691	Debian DSA-2193-1 : libcgroup - several vulnerabilities	Nessus	Debian Local Security Checks	high
52542	RHEL 6 : libcgroup (RHSA-2011:0320)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2011-1022

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high