The cgre_receive_netlink_msg function in daemon/cgrulesengd.c in cgrulesengd in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 does not verify that netlink messages originated in the kernel, which allows local users to bypass intended resource restrictions via a crafted message.

Two security bugfixes in libcgroup1 were done :

libcgroup suffered from a heap based buffer overflow (CVE-2011-1006).

The cgrulesengd daemon did not verify the origin of netlink messages, allowing local users to spoof events (CVE-2011-1022).

libcgroup suffered from a heap based buffer overflow (CVE-2011-1006).

The cgrulesengd daemon did not verify the origin of netlink messages, allowing local users to spoof events (CVE-2011-1022).

From Red Hat Security Advisory 2011:0320 :

Updated libcgroup packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libcgroup packages provide tools and libraries to control and monitor control groups.

A heap-based buffer overflow flaw was found in the way libcgroup converted a list of user-provided controllers for a particular task into an array of strings. A local attacker could use this flaw to escalate their privileges via a specially crafted list of controllers.
(CVE-2011-1006)

It was discovered that libcgroup did not properly check the origin of Netlink messages. A local attacker could use this flaw to send crafted Netlink messages to the cgrulesengd daemon, causing it to put processes into one or more existing control groups, based on the attacker's choosing, possibly allowing the particular tasks to run with more resources (memory, CPU, etc.) than originally intended.
(CVE-2011-1022)

Red Hat would like to thank Nelson Elhage for reporting the CVE-2011-1006 issue.

All libcgroup users should upgrade to these updated packages, which contain backported patches to correct these issues.

A heap-based buffer overflow flaw was found in the way libcgroup converted a list of user-provided controllers for a particular task into an array of strings. A local attacker could use this flaw to escalate their privileges via a specially crafted list of controllers.
(CVE-2011-1006)

It was discovered that libcgroup did not properly check the origin of Netlink messages. A local attacker could use this flaw to send crafted Netlink messages to the cgrulesengd daemon, causing it to put processes into one or more existing control groups, based on the attacker's choosing, possibly allowing the particular tasks to run with more resources (memory, CPU, etc.) than originally intended.
(CVE-2011-1022)

Two security bugs were fixed in this release :

  - CVE-2011-1006: Heap-based buffer overflow by converting     list of controllers for given task into an array of     strings

  - CVE-2011-1022: Unchecked origin of NETLINK messages

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following bugs have been fixed :

  - libcgroup suffered from a heap-based buffer overflow.
    (CVE-2011-1006)

  - The cgrulesengd daemon did not verify the origin of     netlink messages, allowing local users to spoof events.
    (CVE-2011-1022)

Several issues have been discovered in libcgroup, a library to control and monitor control groups :

  - CVE-2011-1006     Heap-based buffer overflow by converting list of     controllers for given task into an array of strings     could lead to privilege escalation by a local attacker.

  - CVE-2011-1022     libcgroup did not properly check the origin of Netlink     messages, allowing a local attacker to send crafted     Netlink messages which could lead to privilege     escalation.

The oldstable distribution (lenny) does not contain libcgroup packages.

Updated libcgroup packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libcgroup packages provide tools and libraries to control and monitor control groups.

A heap-based buffer overflow flaw was found in the way libcgroup converted a list of user-provided controllers for a particular task into an array of strings. A local attacker could use this flaw to escalate their privileges via a specially crafted list of controllers.
(CVE-2011-1006)

It was discovered that libcgroup did not properly check the origin of Netlink messages. A local attacker could use this flaw to send crafted Netlink messages to the cgrulesengd daemon, causing it to put processes into one or more existing control groups, based on the attacker's choosing, possibly allowing the particular tasks to run with more resources (memory, CPU, etc.) than originally intended.
(CVE-2011-1022)

Red Hat would like to thank Nelson Elhage for reporting the CVE-2011-1006 issue.

All libcgroup users should upgrade to these updated packages, which contain backported patches to correct these issues.

ID	Name	Product	Family	Severity
75893	openSUSE Security Update : libcgroup-devel (openSUSE-SU-2011:0316-1)	Nessus	SuSE Local Security Checks	high
75572	openSUSE Security Update : libcgroup-devel (openSUSE-SU-2011:0316-1)	Nessus	SuSE Local Security Checks	high
68218	Oracle Linux 6 : libcgroup (ELSA-2011-0320)	Nessus	Oracle Linux Local Security Checks	high
60979	Scientific Linux Security Update : libcgroup on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
54834	Fedora 13 : libcgroup-0.35.1-5.fc13 (2011-2570)	Nessus	Fedora Local Security Checks	high
53746	openSUSE Security Update : libcgroup-devel (openSUSE-SU-2011:0316-1)	Nessus	SuSE Local Security Checks	high
53358	SuSE 11.1 Security Update : libcgroup (SAT Patch Number 4081)	Nessus	SuSE Local Security Checks	high
52982	Fedora 15 : libcgroup-0.37.1-1.fc15 (2011-2638)	Nessus	Fedora Local Security Checks	high
52981	Fedora 14 : libcgroup-0.36.2-6.fc14 (2011-2631)	Nessus	Fedora Local Security Checks	high
52691	Debian DSA-2193-1 : libcgroup - several vulnerabilities	Nessus	Debian Local Security Checks	high
52542	RHEL 6 : libcgroup (RHSA-2011:0320)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2011-1022

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high