CoreCVE
Back

MEDIUM

kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity

Published Dec 7, 2017

Description

The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system.

Affected products

Remediation

Red Hat statement

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6, as a code with the flaw is not present or is not built in the products listed. This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE. Future Linux kernel updates for the respective releases may address this issue.

Metrics

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-284

References (21)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 7, 2017
Updated Aug 5, 2024
Reserved Dec 6, 2017
Link CVE-2017-17449
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2017-17449
Red Hat
Severity Moderate
Public date Dec 5, 2017
Links CVE-2017-17449 - Bugzilla