In the Linux kernel, the following vulnerability has been resolved:
net: ipip: require CAP_NET_ADMIN in the device netns for changelink
ipip_changelink() operates on at most two netns, dev_net(dev) and the
tunnel link netns t->net. They differ once the device is created in or
moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in t->net can rewrite a tunnel that
lives in t->net.
Gate ipip_changelink() on rtnl_dev_link_net_capable() at its top,
before any attribute is parsed.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/26544021d5c49cc6ae8a968ccb5033e6363854a4
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/68cadc3698c7de88966d306d12ec9c6217da228a
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8211a26324667980a463c069469a818e71207e02
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/91571643e554ae89a91942380d5f5361fb7060a2
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/983cc4aa7e6f633b34c3ee743771252d7afa9a90
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d49edcc65e0a37cc9b386a94415c5d6670ca8b71
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/068ad9b85f681755f751ebab82ae98146cec163d
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a7d2642a50282322bc33f34ee7305f2b793df494
416baaa9-dc9f-4396-8d5f-8c081fb06d67