Re: CVE request: libcgroup: Failure to verify netlink messages

[Steve Grubb <sgrubb () redhat com>]

On Friday, February 25, 2011 12:58:13 am Eugene Teo wrote:
> On 02/25/2011 12:32 PM, Nelson Elhage wrote:
> > The cgrulesengd program from libcgroup failed to properly verify the
> > sender of netlink messages, allowing arbitrary users to spoof events
> > to the daemon, causing it to place processes into incorrect cgroups.
> >
> > Note that the default configuration of cgrulesengd does not contain
> > any any rules, so this is probably only usefully exploitable if an
> > admin have specifically configured cgrulesengd to enforce some policy.
> >
> > References:
> > http://sourceforge.net/mailarchive/message.php?msg_id=27102603
>
> Please use CVE-2011-1022.

That's a shame. I reported this same problem in November last year:

http://sourceforge.net/mailarchive/message.php?msg_id=26598749

The current patch does not check  if (from_nla_len != sizeof(from_nla))  before making 
decisions based on the header. I contacted upstream about this.

-Steve