CVE-2011-1022

2011-03-2217:55:01

Debian Security Bug Tracker

security-tracker.debian.org

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

10.1%

JSON

The cgre_receive_netlink_msg function in daemon/cgrulesengd.c in cgrulesengd in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 does not verify that netlink messages originated in the kernel, which allows local users to bypass intended resource restrictions via a crafted message.

OSVersionArchitecturePackageVersionFilename
Debian12alllibcgroup< 0.37.1-1libcgroup_0.37.1-1_all.deb
Debian11alllibcgroup< 0.37.1-1libcgroup_0.37.1-1_all.deb
Debian999alllibcgroup< 0.37.1-1libcgroup_0.37.1-1_all.deb
Debian13alllibcgroup< 0.37.1-1libcgroup_0.37.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	libcgroup	< 0.37.1-1	libcgroup_0.37.1-1_all.deb
Debian	11	all	libcgroup	< 0.37.1-1	libcgroup_0.37.1-1_all.deb
Debian	999	all	libcgroup	< 0.37.1-1	libcgroup_0.37.1-1_all.deb
Debian	13	all	libcgroup	< 0.37.1-1	libcgroup_0.37.1-1_all.deb