CVE-2011-1006

libcgroup: Heap-based buffer overflow by converting list of controllers for given task into an array of strings

Severity Score

7.2

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Heap-based buffer overflow in the parse_cgroup_spec function in tools/tools-common.c in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 allows local users to gain privileges via a crafted controller list on the command line of an application. NOTE: it is not clear whether this issue crosses privilege boundaries.

Desbordamiento de buffer de memoria dinámica en la función parse_cgroup_spec de tools/tools-common.c de la librería "Control Group Configuration" (libcgroup o libcg) en versiones anteriores a la 0.37.1. Permite a usuarios locales escalar privilegios a través de una lista de controladores modificada en la línea de comandos de un aplicación. NOTA: no está claro si este problema traspasa las restricciones de privilegios.

*Credits: N/A

CVSS Scores

NISTv2 7.2

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-02-14 CVE Reserved
2011-03-17 CVE Published
2023-03-08 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-122: Heap-based Buffer Overflow

CAPEC

References (17)

URL	Tag	Source
http://libcg.git.sourceforge.net/git/gitweb.cgi?p=libcg/libcg%3Ba=commit%3Bh=5ae8aea1ecd60c439121d3329d8eaabf13d292c1	X_refsource_confirm
http://secunia.com/advisories/43891	Third Party Advisory
http://secunia.com/advisories/44093	Third Party Advisory
http://www.securityfocus.com/bid/46729	Vdb Entry
http://www.securitytracker.com/id?1025158	Vdb Entry
http://www.vupen.com/english/advisories/2011/0774	Vdb Entry

URL	Date	SRC

URL	Date	SRC
http://sourceforge.net/projects/libcg/files/libcgroup/v0.37.1/libcgroup-0.37.1.tar.bz2/download	2023-11-07
https://bugzilla.redhat.com/show_bug.cgi?id=678107	2011-03-03

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056683.html	2023-11-07
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056734.html	2023-11-07
http://lists.opensuse.org/opensuse-updates/2011-04/msg00027.html	2023-11-07
http://secunia.com/advisories/43611	2023-11-07
http://secunia.com/advisories/43758	2023-11-07
http://www.debian.org/security/2011/dsa-2193	2023-11-07
http://www.redhat.com/support/errata/RHSA-2011-0320.html	2023-11-07
http://www.vupen.com/english/advisories/2011/0679	2023-11-07
https://access.redhat.com/security/cve/CVE-2011-1006	2011-03-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				<= 0.37 Search vendor "Balbir Singh" for product "Libcgroup" and version " <= 0.37"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.1b Search vendor "Balbir Singh" for product "Libcgroup" and version "0.1b"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.1c Search vendor "Balbir Singh" for product "Libcgroup" and version "0.1c"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.2 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.2"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.3 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.3"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.31 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.31"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.32 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.32"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.32.1 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.32.1"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.32.2 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.32.2"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.33 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.33"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.34 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.34"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.35 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.35"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.35.1 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.35.1"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.36 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.36"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.36.1 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.36.1"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.36.2 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.36.2"		-		Affected
Balbir Singh Search vendor "Balbir Singh"		Libcgroup Search vendor "Balbir Singh" for product "Libcgroup"				0.37 Search vendor "Balbir Singh" for product "Libcgroup" and version "0.37"		rc1		Affected