PT-2011-1039 · Linux+1 · Libcgroup-Debuginfo+4

Jan Lieskovsky · Published 2011-03-03 · Updated 2011-09-07 · CVE-2011-1022

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libcgroup versions prior to 0.37.1 libcgroup-pam version 0.36.1 libcgroup-devel version 0.36.1 libcgroup-debuginfo version 0.36.1

Description The issue concerns multiple vulnerabilities in the libcgroup package, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally, allowing attackers to bypass intended resource restrictions. The cgre receive netlink msg function in daemon/cgrulesengd.c does not verify that netlink messages originated in the kernel, enabling local users to exploit this weakness via crafted messages.

Recommendations For versions prior to 0.37.1, update to version 0.37.1 or later to resolve the issue. For libcgroup-pam version 0.36.1, update to a version that includes the fix for this vulnerability. For libcgroup-devel version 0.36.1, update to a version that includes the fix for this vulnerability. For libcgroup-debuginfo version 0.36.1, update to a version that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the cgre receive netlink msg function until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-264

Related Identifiers

BDU:2015-02876

BDU:2015-05991

BDU:2015-05992

BDU:2015-05993

BDU:2015-05994

CVE-2011-1022

DSA-2193-1

OPENSUSE-SU-2024:10391-1

RHSA-2011:0320

RHSA-2011_0320

Affected Products

Red Hat

Libcgroup

Libcgroup-Debuginfo

Libcgroup-Devel

Libcgroup-Pam

References · 43

• http://openwall.com/lists/oss-security/2011/02/25/12 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-1022 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/02/25/9 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1022 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/02/25/11 · Patch
• http://lists.opensuse.org/opensuse-updates/2011-04/msg00027.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-1022 · Vendor Advisory
• http://sourceforge.net/projects/libcg/files/libcgroup/v0.37.1/libcgroup-0.37.1.tar.bz2/download · Patch
• https://security-tracker.debian.org/tracker/CVE-2011-1022 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056683.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=680409 · Patch
• https://bdu.fstec.ru/vul/2015-02876 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056734.html · Vendor Advisory
• http://secunia.com/advisories/43611 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1022 · Security Note