Description

In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device. john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0). Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel) correctly set this flag during their fallback device initialization to prevent them from being moved to another network namespace.

References 3

• git.kernel.org https://git.kernel.org/stable/c/d289d5307762d1838aaece22c6b6fcad9e8865f9
• git.kernel.org https://git.kernel.org/stable/c/dcdce3bc9f08026ff3739ee7339e1bef526fc5f3
• git.kernel.org https://git.kernel.org/stable/c/ecf8904067dcba0dad86ece80874841e60317885

Remediation