Executive Summary

This vulnerability exists in the Linux kernel's rtnetlink component, specifically in the rtnl_newlink() function. The issue is that there is a missing capability check (netlink_ns_capable()) for the CAP_NET_ADMIN permission on the peer network namespace when creating paired network devices such as veth, vxcan, and netkit.

Because of this missing check, an unprivileged user who has a user namespace can create network interfaces in arbitrary network namespaces, including the init_net namespace, which is typically highly privileged.

The fix involves adding the netlink_ns_capable() check to verify that the user has CAP_NET_ADMIN capability in the peer namespace before allowing the creation of these devices.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unprivileged user with a user namespace to create network interfaces in arbitrary network namespaces, including highly privileged ones like init_net.

This could lead to unauthorized network configuration changes, potentially enabling privilege escalation, network disruption, or bypassing network security controls.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the patch adding the netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace has been applied.

This patch prevents unprivileged users with user namespaces from creating network interfaces in arbitrary network namespaces, including init_net.

Until the update is applied, restrict unprivileged user namespaces or limit access to network namespace creation to trusted users only.

Useful 0 Not Useful 0