Описание
In the Linux kernel, the following vulnerability has been resolved:
amt: Don't support cross-netns setup.
When a lower device is unregistered, amt_device_event() tries to unregister its upper AMT device, but it has two problems.
-
amt_lookup_upper_dev() looks up an upper device in the lower device's netns only
-
amt_device_event() unregisters a single upper device only
If AMT device is created on a lower device in another netns, removing the lower device triggers the splat below and gets stuck until all upper devices are removed. [0]
The cross-netns setup seems unintentional considering 1. and the following points:
- amt_link_setup() sets dev->netns_immutable to true
- skb_scrub_packet() is not called in the fast path
- iproute2 binary fails to find cross-netns lower device via
link-netns:
ip -n ns1 link add amt0 link-netns ns2 type amt dev veth1
Cannot find device "veth1"
Instead of supporting it properly and preparing for per-netns netdev u
EPSS
Дефекты
Связанные уязвимости
(In the Linux kernel, the following vulnerability has been resolved: a ...)
In the Linux kernel, the following vulnerability has been resolved: a ...
In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amt_device_event() tries to unregister its upper AMT device, but it has two problems. 1. amt_lookup_upper_dev() looks up an upper device in the lower device's netns only 2. amt_device_event() unregisters a single upper device only If AMT device is created on a lower device in another netns, removing the lower device triggers the splat below and gets stuck until all upper devices are removed. [0] The cross-netns setup seems unintentional considering 1. and the following points: * amt_link_setup() sets dev->netns_immutable to true * skb_scrub_packet() is not called in the fast path * iproute2 binary fails to find cross-netns lower device via link-netns: # ip -n ns1 link add amt0 link-netns ns2 type amt dev veth1 Cannot find device "veth1" Instead of supporting it properly and preparing for per-netns netde...
EPSS