A macvlan device can be moved to a network namespace whose user namespace does not administer the lower device. The rtnetlink changelink path checks CAP_NET_ADMIN only in the macvlan device network namespace. However, IFLA_MACVLAN_BC_QUEUE_LEN and IFLA_MACVLAN_BC_CUTOFF update macvlan_port fields shared by every macvlan on the lower device. A caller can also create a nested macvlan on the moved device. macvlan_common_newlink() resolves that device to the real lower device without rechecking access to its network namespace. Xiang Mei reported that a caller can set the shared broadcast queue length to U32_MAX from an unprivileged user namespace and grow the host backlog until OOM under an incoming broadcast flood. A fixed numeric limit was proposed, but legitimate deployments use queue lengths of 100000 or more. Require CAP_NET_ADMIN in the lower device network namespace for shared port changes and nested macvlan creation. Per-device settings remain available to an administrator of the macvlan device network namespace. This matches the permission model used by ipvlan. Found by 0sec automated security-research tooling (https://0sec.ai). Reported-by: Xiang Mei (Microsoft) Closes: https://lore.kernel.org/r/20260706212556.3199234-1-xmei5@asu.edu Fixes: d4bff72c8401 ("macvlan: Support for high multicast packet rate") Cc: stable@vger.kernel.org Assisted-by: 0sec:multi-model Signed-off-by: Doruk Tan Ozturk --- drivers/net/macvlan.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index 9a4bc99dbf53b..22f03b206c718 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -1483,8 +1483,11 @@ int macvlan_common_newlink(struct net_device *dev, /* When creating macvlans or macvtaps on top of other macvlans - use * the real device as the lowerdev. */ - if (netif_is_macvlan(lowerdev)) + if (netif_is_macvlan(lowerdev)) { lowerdev = macvlan_dev_real_dev(lowerdev); + if (!rtnl_dev_link_net_capable(dev, dev_net(lowerdev))) + return -EPERM; + } if (!tb[IFLA_MTU]) dev->mtu = lowerdev->mtu; @@ -1623,6 +1626,12 @@ static int macvlan_changelink(struct net_device *dev, enum macvlan_macaddr_mode macmode; int ret; + if (data && + (data[IFLA_MACVLAN_BC_QUEUE_LEN] || + data[IFLA_MACVLAN_BC_CUTOFF]) && + !rtnl_dev_link_net_capable(dev, dev_net(vlan->lowerdev))) + return -EPERM; + /* Validate mode, but don't set yet: setting flags may fail. */ if (data && data[IFLA_MACVLAN_MODE]) { set_mode = true; -- 2.43.0