rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net. Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation to proceed. Fixes: 81adee47dfb6 ("net: Support specifying the network namespace upon device creation.") Signed-off-by: Nikolaos Gkarlis --- v2: - Removed "Reported-by" tag - Fixed "Fixes" tag with the help of Kuniyuki Iwashima (thanks !) net/core/rtnetlink.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index fae8034efbf..ee7d9d65b2c 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -4059,8 +4059,15 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh, ret = PTR_ERR(peer_net); goto put_ops; } - if (peer_net) + if (peer_net) { + if (!netlink_ns_capable(skb, peer_net->user_ns, + CAP_NET_ADMIN)) { + put_net(peer_net); + ret = -EPERM; + goto put_ops; + } rtnl_nets_add(&rtnl_nets, peer_net); + } } } -- 2.34.1