Re: CVE request: libcgroup: Failure to verify netlink messages

[Eugene Teo <eugene () redhat com>]

On 02/25/2011 12:32 PM, Nelson Elhage wrote:
> The cgrulesengd program from libcgroup failed to properly verify the
> sender of netlink messages, allowing arbitrary users to spoof events
> to the daemon, causing it to place processes into incorrect cgroups.
>
> Note that the default configuration of cgrulesengd does not contain
> any any rules, so this is probably only usefully exploitable if an
> admin have specifically configured cgrulesengd to enforce some policy.
>
> References:
> http://sourceforge.net/mailarchive/message.php?msg_id=27102603

Please use CVE-2011-1022.

Eugene
--
Eugene Teo / Red Hat Security Response Team