oss-sec mailing list archives
CVE request: libcgroup: Failure to verify netlink messages
From: Nelson Elhage <nelhage () ksplice com>
Date: Thu, 24 Feb 2011 23:32:40 -0500
The cgrulesengd program from libcgroup failed to properly verify the sender of netlink messages, allowing arbitrary users to spoof events to the daemon, causing it to place processes into incorrect cgroups. Note that the default configuration of cgrulesengd does not contain any any rules, so this is probably only usefully exploitable if an admin have specifically configured cgrulesengd to enforce some policy. References: http://sourceforge.net/mailarchive/message.php?msg_id=27102603 - Nelson
Current thread:
- CVE request: libcgroup: Failure to verify netlink messages Nelson Elhage (Feb 24)
- Re: CVE request: libcgroup: Failure to verify netlink messages Eugene Teo (Feb 24)
- Re: CVE request: libcgroup: Failure to verify netlink messages Steve Grubb (Feb 25)
- Re: CVE request: libcgroup: Failure to verify netlink messages Nelson Elhage (Feb 25)
- Re: CVE request: libcgroup: Failure to verify netlink messages Steve Grubb (Feb 25)
- Re: CVE request: libcgroup: Failure to verify netlink messages Steve Grubb (Feb 25)
- Re: CVE request: libcgroup: Failure to verify netlink messages Eugene Teo (Feb 24)