Description
In the Linux kernel, the following vulnerability has been resolved: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink vti_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate vti_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
895de9a3488abcdd186680f0af3cce7f2d4d4a6e to < 1caf737e625143c6f23c32d2b747b1a3e42e5699affected895de9a3488abcdd186680f0af3cce7f2d4d4a6e to < 32edf8aa297745226854eda2d96c0fac66c1bb15affected895de9a3488abcdd186680f0af3cce7f2d4d4a6e to < 973ead9e565423642e4533e1547b5d2c0476fb03affected895de9a3488abcdd186680f0af3cce7f2d4d4a6e to < 33fd93961557ec8e3e9958995b28684c5f949394affected895de9a3488abcdd186680f0af3cce7f2d4d4a6e to < 6d8bc0dc99472d62c57c2a3d436e6ab408592bdaaffected895de9a3488abcdd186680f0af3cce7f2d4d4a6e to < 9571af2eec8023af9a1671b7f2cd4ab400011724affected895de9a3488abcdd186680f0af3cce7f2d4d4a6e to < 88b33ee458a6ca5fbef6c53b9dba772da69dab68affected895de9a3488abcdd186680f0af3cce7f2d4d4a6e to < 95cceadbfd52d7239bd730afdda0655287d77425affected
Linux Linux
Default version status: affected
3.15affected0 to < 3.15unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1caf737e625143c6f23c32d2b747b1a3e42e5699 ↗
- https://git.kernel.org/stable/c/32edf8aa297745226854eda2d96c0fac66c1bb15 ↗
- https://git.kernel.org/stable/c/973ead9e565423642e4533e1547b5d2c0476fb03 ↗
- https://git.kernel.org/stable/c/33fd93961557ec8e3e9958995b28684c5f949394 ↗
- https://git.kernel.org/stable/c/6d8bc0dc99472d62c57c2a3d436e6ab408592bda ↗
- https://git.kernel.org/stable/c/9571af2eec8023af9a1671b7f2cd4ab400011724 ↗
- https://git.kernel.org/stable/c/88b33ee458a6ca5fbef6c53b9dba772da69dab68 ↗
- https://git.kernel.org/stable/c/95cceadbfd52d7239bd730afdda0655287d77425 ↗