[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201102251020.02709.sgrubb@redhat.com>
Date: Fri, 25 Feb 2011 10:20:02 -0500
From: Steve Grubb <sgrubb@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Eugene Teo <eugene@...hat.com>, Nelson Elhage <nelhage@...lice.com>
Subject: Re: CVE request: libcgroup: Failure to verify netlink messages
On Friday, February 25, 2011 12:58:13 am Eugene Teo wrote:
> On 02/25/2011 12:32 PM, Nelson Elhage wrote:
> > The cgrulesengd program from libcgroup failed to properly verify the
> > sender of netlink messages, allowing arbitrary users to spoof events
> > to the daemon, causing it to place processes into incorrect cgroups.
> >
> > Note that the default configuration of cgrulesengd does not contain
> > any any rules, so this is probably only usefully exploitable if an
> > admin have specifically configured cgrulesengd to enforce some policy.
> >
> > References:
> > http://sourceforge.net/mailarchive/message.php?msg_id=27102603
>
> Please use CVE-2011-1022.
That's a shame. I reported this same problem in November last year:
http://sourceforge.net/mailarchive/message.php?msg_id=26598749
The current patch does not check if (from_nla_len != sizeof(from_nla)) before making
decisions based on the header. I contacted upstream about this.
-Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
