« Volver al listado

CVE-2011-1006

Estado: ModificadaAlta (7.2)—

Heap-based buffer overflow in the parse_cgroup_spec function in tools/tools-common.c in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 allows local users to gain privileges via a crafted controller list on the command line of an application. NOTE: it is not clear whether this issue crosses privilege boundaries.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Balbir Singh — Libcgroup

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-1006",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-03-22T17:55:01.300",
  "references": [
    {
      "url": "http://libcg.git.sourceforge.net/git/gitweb.cgi?p=libcg/libcg%3Ba=commit%3Bh=5ae8aea1ecd60c439121d3329d8eaabf13d292c1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056683.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056734.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2011-04/msg00027.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/43611",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/43758",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/43891",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/44093",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://sourceforge.net/projects/libcg/files/libcgroup/v0.37.1/libcgroup-0.37.1.tar.bz2/download",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2011/dsa-2193",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2011-0320.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/46729",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1025158",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0679",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0774",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=678107",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://libcg.git.sourceforge.net/git/gitweb.cgi?p=libcg/libcg%3Ba=commit%3Bh=5ae8aea1ecd60c439121d3329d8eaabf13d292c1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056683.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056734.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2011-04/msg00027.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/43611",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/43758",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/43891",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/44093",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/projects/libcg/files/libcgroup/v0.37.1/libcgroup-0.37.1.tar.bz2/download",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2011/dsa-2193",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2011-0320.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/46729",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1025158",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0679",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0774",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=678107",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the parse_cgroup_spec function in tools/tools-common.c in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 allows local users to gain privileges via a crafted controller list on the command line of an application.  NOTE: it is not clear whether this issue crosses privilege boundaries."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de buffer de memoria dinámica en la función parse_cgroup_spec de tools/tools-common.c de la librería \"Control Group Configuration\" (libcgroup o libcg) en versiones anteriores a la 0.37.1.  Permite a usuarios locales escalar privilegios a través de una lista de controladores modificada en la línea de comandos de un aplicación. NOTA: no está claro si este problema traspasa las restricciones de privilegios."
    }
  ],
  "lastModified": "2026-06-16T23:28:32.397",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF0BCCAA-81E9-437F-BA72-BA4CD06A486C",
              "versionEndIncluding": "0.37"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.1b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43F309E6-1832-4E2E-9E08-AC86FDBB5F53"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.1c:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DDACB92-6E32-49BB-8C1C-2897CC848208"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07C80D9D-E561-4703-96AD-A94EAC8E164B"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8633EB57-9EE8-4653-B8F6-A25465A9EA17"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59F48A0C-3B96-43B9-9B69-54823BA06750"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.32:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "653BEE43-D5D5-4CF9-82A1-F6FCD9FF4888"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.32.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE89E298-CAEF-422C-9CCD-681A199BC57F"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.32.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C27CEFA-E730-4B14-ADEB-88D176C009ED"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.33:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "845A2CE5-0787-4A27-B49B-E254F19BB3A5"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.34:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E87B161B-5DF9-42F0-82FE-D2E277B894C4"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.35:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3C8A145-D946-4F34-A40D-CC97B92D43B4"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.35.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8910F268-5B95-4459-9411-222DCD85BFF8"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.36:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0ED72E4-64CD-4A8C-8911-7DC362D40A69"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.36.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE35D91B-E874-4E60-ACB4-42102393264E"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.36.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F28E1E9-3AB9-484E-A4AC-338893DE9E4F"
            },
            {
              "criteria": "cpe:2.3:a:balbir_singh:libcgroup:0.37:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "208A5A77-C092-4F84-B8C7-476A2321AFBA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}