[Trusty][Xenial][Zesty][Artful][PATCH 0/1] CVE-2017-17449

[Khalid Elmously]

CVE-2017-17449


The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the
Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not
restrict observations of Netlink messages to a single net namespace, which
allows local users to obtain sensitive information by leveraging the
CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink
activity on the system.

(The patch will be fuzzed by a few lines for Trusty but should still apply cleanly)

(cherry-picked from upstream 93c647643b48f0131f02e45da3bd367d80443291)

Kevin Cernekee (1):
  netlink: Add netns check on taps

 net/netlink/af_netlink.c | 3 +++
 1 file changed, 3 insertions(+)

-- 
2.14.1