Description
In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate both ops on rtnl_dev_link_net_capable() at their top, before any attribute is parsed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
690afc165bb314354667f67157c1a1aea7dc797a to < 129f8939e5af683cec3a1a5edcb40a64636ad81eaffected690afc165bb314354667f67157c1a1aea7dc797a to < e3724dedf57761c6de52f4d604ec74f66fd61611affected690afc165bb314354667f67157c1a1aea7dc797a to < 220162c9fedbe992da70d70f50a10da4f45f914caffected690afc165bb314354667f67157c1a1aea7dc797a to < 1d4d8ee002083ca4ead5353662bf8362428af57faffected690afc165bb314354667f67157c1a1aea7dc797a to < 0caa9f348f8b5356900de77b0bb89a697c4aff20affected690afc165bb314354667f67157c1a1aea7dc797a to < 03d8843b143ebbbfaf48511922abc6e886575a61affected690afc165bb314354667f67157c1a1aea7dc797a to < c38c8b0db3c65b597e7ece317b6cb59de3d15e69affected690afc165bb314354667f67157c1a1aea7dc797a to < f00a50876d2818bd6dc86fa98b3ef360884c53c8affectedd0201d2405dac8d9b16773e97709925e397552d0affected7943bb0f06365cf5e32f3cf8a6b29eeae981fb8aaffected4.19.100 to < 4.20affected5.4.16 to < 5.5affected
Linux Linux
Default version status: affected
5.5affected0 to < 5.5unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/129f8939e5af683cec3a1a5edcb40a64636ad81e ↗
- https://git.kernel.org/stable/c/e3724dedf57761c6de52f4d604ec74f66fd61611 ↗
- https://git.kernel.org/stable/c/220162c9fedbe992da70d70f50a10da4f45f914c ↗
- https://git.kernel.org/stable/c/1d4d8ee002083ca4ead5353662bf8362428af57f ↗
- https://git.kernel.org/stable/c/0caa9f348f8b5356900de77b0bb89a697c4aff20 ↗
- https://git.kernel.org/stable/c/03d8843b143ebbbfaf48511922abc6e886575a61 ↗
- https://git.kernel.org/stable/c/c38c8b0db3c65b597e7ece317b6cb59de3d15e69 ↗
- https://git.kernel.org/stable/c/f00a50876d2818bd6dc86fa98b3ef360884c53c8 ↗