CVE-2011-1022

The cgre_receive_netlink_msg function in daemon/cgrulesengd.c in cgrulesengd in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 does not verify that netlink messages originated in the kernel, which allows local users to bypass intended resource restrictions via a crafted message.

Published: 2011-03-22 Last update: 2026-04-29 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2011-1022 is rated Low Risk (12.8/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.04%). Low composite risk—no urgent action required; patch on your normal maintenance cycle and revisit priority if CVSS or EPSS increases.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2011-1022

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-12-14 0.08% 0.04% -0.04%
2 2025-03-17 0.04% 0.08% +0.04%
3 2023-03-07 — 0.04% —

Full EPSS history (4 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2011-1022

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
2.1 2.0 LOW
AV:L/AC:L/Au:N/C:N/I:P/A:N Click to expand
Access vector (AV:L)
Requires local access to the target system.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:N)
No availability impact.
 3.9 2.9 [email protected]

Weakness enumeration for CVE-2011-1022

OS Trackers for CVE-2011-1022

vendor priority summary link
debian not yet assigned CVE-2011-1022 not yet assigned priority: Debian including 1 source packages (libcgroup), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2011-1022
redhat low — https://access.redhat.com/security/cve/CVE-2011-1022
ubuntu medium CVE-2011-1022 medium priority: Ubuntu including 1 source packages (libcgroup), 21 status rows across 21 suites (artful, bionic, dapper, hardy, karmic, lucid, maverick, natty, oneiric, precise, quantal, raring, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): ignored 14, not-affected 3, DNE 2, released 2. https://ubuntu.com/security/CVE-2011-1022

Affected software / configurations for CVE-2011-1022

Vendor Product Version Raw CPE
balbir_singh libcgroup <= 0.37 cpe:2.3:a:balbir_singh:libcgroup:*:*:*:*:*:*:*:*
balbir_singh libcgroup 0.1b cpe:2.3:a:balbir_singh:libcgroup:0.1b:*:*:*:*:*:*:*
balbir_singh libcgroup 0.1c cpe:2.3:a:balbir_singh:libcgroup:0.1c:*:*:*:*:*:*:*
balbir_singh libcgroup 0.2 cpe:2.3:a:balbir_singh:libcgroup:0.2:*:*:*:*:*:*:*
balbir_singh libcgroup 0.3 cpe:2.3:a:balbir_singh:libcgroup:0.3:*:*:*:*:*:*:*
balbir_singh libcgroup 0.31 cpe:2.3:a:balbir_singh:libcgroup:0.31:*:*:*:*:*:*:*
balbir_singh libcgroup 0.32 cpe:2.3:a:balbir_singh:libcgroup:0.32:*:*:*:*:*:*:*
balbir_singh libcgroup 0.32.1 cpe:2.3:a:balbir_singh:libcgroup:0.32.1:*:*:*:*:*:*:*
balbir_singh libcgroup 0.32.2 cpe:2.3:a:balbir_singh:libcgroup:0.32.2:*:*:*:*:*:*:*
balbir_singh libcgroup 0.33 cpe:2.3:a:balbir_singh:libcgroup:0.33:*:*:*:*:*:*:*
balbir_singh libcgroup 0.34 cpe:2.3:a:balbir_singh:libcgroup:0.34:*:*:*:*:*:*:*
balbir_singh libcgroup 0.35 cpe:2.3:a:balbir_singh:libcgroup:0.35:*:*:*:*:*:*:*
balbir_singh libcgroup 0.35.1 cpe:2.3:a:balbir_singh:libcgroup:0.35.1:*:*:*:*:*:*:*
balbir_singh libcgroup 0.36 cpe:2.3:a:balbir_singh:libcgroup:0.36:*:*:*:*:*:*:*
balbir_singh libcgroup 0.36.1 cpe:2.3:a:balbir_singh:libcgroup:0.36.1:*:*:*:*:*:*:*
balbir_singh libcgroup 0.36.2 cpe:2.3:a:balbir_singh:libcgroup:0.36.2:*:*:*:*:*:*:*
balbir_singh libcgroup 0.37 cpe:2.3:a:balbir_singh:libcgroup:0.37:rc1:*:*:*:*:*:*

References for CVE-2011-1022

URL Tags
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615987 Patch
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056683.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056734.html
http://lists.opensuse.org/opensuse-updates/2011-04/msg00027.html
http://openwall.com/lists/oss-security/2011/02/25/11 Patch
http://openwall.com/lists/oss-security/2011/02/25/12 Patch
http://openwall.com/lists/oss-security/2011/02/25/14
http://openwall.com/lists/oss-security/2011/02/25/6 Patch
http://openwall.com/lists/oss-security/2011/02/25/9 Patch
http://secunia.com/advisories/43611 Vendor Advisory
http://secunia.com/advisories/43758 Vendor Advisory
http://secunia.com/advisories/43891
http://secunia.com/advisories/44093
http://sourceforge.net/mailarchive/message.php?msg_id=26598749 Patch
http://sourceforge.net/mailarchive/message.php?msg_id=27102603 Patch
http://sourceforge.net/projects/libcg/files/libcgroup/v0.37.1/libcgroup-0.37.1.tar.bz2/download Patch
http://www.debian.org/security/2011/dsa-2193
http://www.redhat.com/support/errata/RHSA-2011-0320.html
http://www.securityfocus.com/bid/46578
http://www.securitytracker.com/id?1025157
http://www.vupen.com/english/advisories/2011/0679 Vendor Advisory
http://www.vupen.com/english/advisories/2011/0774
https://bugzilla.redhat.com/show_bug.cgi?id=680409 Patch
cvelogic Threat Intelligence