Description
In the Linux kernel, the following vulnerability has been resolved: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate ip6_tnl_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0bd8762824e73a3cce7b7560a97463301764b616 to < 2d53ee7daabe733deb81f51d2cc90188f8ad59a1affected0bd8762824e73a3cce7b7560a97463301764b616 to < 82e53e7281c71e174f9f5877c566a623c637b406affected0bd8762824e73a3cce7b7560a97463301764b616 to < 5252db8fb604321133138c7069d6fc3fcd89cdeeaffected0bd8762824e73a3cce7b7560a97463301764b616 to < 2636d061bc237a2446a146e42dcc6563acfa7432affected0bd8762824e73a3cce7b7560a97463301764b616 to < 7f68f7928484f463a5bc0d50e6fdd8d16f55a5aaaffected0bd8762824e73a3cce7b7560a97463301764b616 to < 234cd54fc500f69db43e37de38603da617fbbeeaaffected0bd8762824e73a3cce7b7560a97463301764b616 to < d4bcc202a3530c856e1cb183384bc9cc8fddab22affected0bd8762824e73a3cce7b7560a97463301764b616 to < 2496fa0b7d180b3ad356b514e7ff93bb14e6140aaffected
Linux Linux
Default version status: affected
3.12affected0 to < 3.12unaffected5.10.266 to ≤ 5.10.*unaffected5.15.217 to ≤ 5.15.*unaffected6.1.184 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2d53ee7daabe733deb81f51d2cc90188f8ad59a1 ↗
- https://git.kernel.org/stable/c/82e53e7281c71e174f9f5877c566a623c637b406 ↗
- https://git.kernel.org/stable/c/5252db8fb604321133138c7069d6fc3fcd89cdee ↗
- https://git.kernel.org/stable/c/2636d061bc237a2446a146e42dcc6563acfa7432 ↗
- https://git.kernel.org/stable/c/7f68f7928484f463a5bc0d50e6fdd8d16f55a5aa ↗
- https://git.kernel.org/stable/c/234cd54fc500f69db43e37de38603da617fbbeea ↗
- https://git.kernel.org/stable/c/d4bcc202a3530c856e1cb183384bc9cc8fddab22 ↗
- https://git.kernel.org/stable/c/2496fa0b7d180b3ad356b514e7ff93bb14e6140a ↗