Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 25 Feb 2011 13:58:13 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: Nelson Elhage <nelhage@...lice.com>
Subject: Re: CVE request: libcgroup: Failure to verify netlink
 messages

On 02/25/2011 12:32 PM, Nelson Elhage wrote:
> The cgrulesengd program from libcgroup failed to properly verify the
> sender of netlink messages, allowing arbitrary users to spoof events
> to the daemon, causing it to place processes into incorrect cgroups.
>
> Note that the default configuration of cgrulesengd does not contain
> any any rules, so this is probably only usefully exploitable if an
> admin have specifically configured cgrulesengd to enforce some policy.
>
> References:
> http://sourceforge.net/mailarchive/message.php?msg_id=27102603

Please use CVE-2011-1022.

Eugene
-- 
Eugene Teo / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.