Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 25 Feb 2011 10:43:20 -0500
From: Nelson Elhage <>
To: Steve Grubb <>
Cc:, Eugene Teo <>
Subject: Re: CVE request: libcgroup: Failure to verify
 netlink messages

On Fri, Feb 25, 2011 at 10:20:02AM -0500, Steve Grubb wrote:
> On Friday, February 25, 2011 12:58:13 am Eugene Teo wrote:
> > On 02/25/2011 12:32 PM, Nelson Elhage wrote:
> > > The cgrulesengd program from libcgroup failed to properly verify the
> > > sender of netlink messages, allowing arbitrary users to spoof events
> > > to the daemon, causing it to place processes into incorrect cgroups.
> > > 
> > > Note that the default configuration of cgrulesengd does not contain
> > > any any rules, so this is probably only usefully exploitable if an
> > > admin have specifically configured cgrulesengd to enforce some policy.
> > > 
> > > References:
> > >
> > 
> > Please use CVE-2011-1022.
> That's a shame. I reported this same problem in November last year:
> The current patch does not check if (from_nla_len != sizeof(from_nla)) before
> making decisions based on the header. I contacted upstream about this.

>From my reading of the netlink code, recvmsg() / recvfrom() on a netlink socket
will never return a from_nla_len != sizeof(struct sockaddaddr_nl). Am I missing
something, did this change at some point, or are you just suggesting general
paranoid good practice? It's probably good advice in any case, I'm just curious
whether you're aware of cases where this can actually be a problem.

- Nelson

> -Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.