Description
In the Linux kernel, the following vulnerability has been resolved: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink vti6_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
61220ab349485d911083d0b7990ccd3db6c63297 to < f5254e7766b4ac02b66b2ccef896cd278503cb11affected61220ab349485d911083d0b7990ccd3db6c63297 to < ef897249dc957089e6f7f11ceea699e093ad51bdaffected61220ab349485d911083d0b7990ccd3db6c63297 to < f6e8b52a2cb3bbd72ddc2d44e474b907b9dcf5baaffected61220ab349485d911083d0b7990ccd3db6c63297 to < c64b9ae7eb97e81d54b792910a3aeafd92566c79affected61220ab349485d911083d0b7990ccd3db6c63297 to < b2b61c540571b3cc2f461e2a579ba2cc8c2a52cfaffected61220ab349485d911083d0b7990ccd3db6c63297 to < 0b2f9c908f930ec4be17d389723f9a202d6a883caffected61220ab349485d911083d0b7990ccd3db6c63297 to < f97e93ebf2f9b8ef3b87f7a9371255e84d151587affected61220ab349485d911083d0b7990ccd3db6c63297 to < e2ac3b242c37dff323a964962e43854f4b1a2b79affected
Linux Linux
Default version status: affected
3.15affected0 to < 3.15unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f5254e7766b4ac02b66b2ccef896cd278503cb11 ↗
- https://git.kernel.org/stable/c/ef897249dc957089e6f7f11ceea699e093ad51bd ↗
- https://git.kernel.org/stable/c/f6e8b52a2cb3bbd72ddc2d44e474b907b9dcf5ba ↗
- https://git.kernel.org/stable/c/c64b9ae7eb97e81d54b792910a3aeafd92566c79 ↗
- https://git.kernel.org/stable/c/b2b61c540571b3cc2f461e2a579ba2cc8c2a52cf ↗
- https://git.kernel.org/stable/c/0b2f9c908f930ec4be17d389723f9a202d6a883c ↗
- https://git.kernel.org/stable/c/f97e93ebf2f9b8ef3b87f7a9371255e84d151587 ↗
- https://git.kernel.org/stable/c/e2ac3b242c37dff323a964962e43854f4b1a2b79 ↗