Description
The cgre_receive_netlink_msg function in daemon/cgrulesengd.c in cgrulesengd in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 does not verify that netlink messages originated in the kernel, which allows local users to bypass intended resource restrictions via a crafted message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcgroup | 0.37.1-1 | — |
| Debian 13 | libcgroup | 0.37.1-1 | — |
| Debian 12 | libcgroup | 0.37.1-1 | — |
| Debian 6.0 | libcgroup | 0.36.2-3+squeeze1 | DSA-2193-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libcgroup +2 | 0.36.1-6.el6_0.1 | RHSA-2011:0320 |
Advisories 2
- RHSA-2011:0320 Red Hat Security Advisory: libcgroup security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2193-1 libcgroup - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20110225 Re: CVE request: libcgroup: Failure to verify netlink messages mailing-list
- 43758 third-party-advisory
- 44093 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615987
- 1025157 vdb-entry
- 46578 vdb-entry
- http://sourceforge.net/projects/libcg/files/libcgroup/v0.37.1/libcgroup-0.37.1.tar.bz2/download
- 43891 third-party-advisory
- DSA-2193 vendor-advisory
- openSUSE-SU-2011:0316 vendor-advisory
- FEDORA-2011-2631 vendor-advisory
- ADV-2011-0679 vdb-entry
- ADV-2011-0774 vdb-entry
- [libcg-devel] 20101115 Fwd: libcgroup netlink mailing-list
- [oss-security] 20110225 Re: CVE request: libcgroup: Failure to verify netlink messages mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=680409
- RHSA-2011:0320 vendor-advisory
- [oss-security] 20110225 Re: CVE request: libcgroup: Failure to verify netlink messages mailing-list
- 43611 third-party-advisory
- FEDORA-2011-2638 vendor-advisory
- [oss-security] 20110224 CVE request: libcgroup: Failure to verify netlink messages mailing-list
- [oss-security] 20110225 Re: CVE request: libcgroup: Failure to verify netlink messages mailing-list
- [libcg-devel] 20110218 [PATCH 2/2] cgrulesengd: Ignore netlink messages that don't come from the kernel. mailing-list