Remote No

Type Information disclosure

Description

The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel before 4.14.11, 4.9.74, 4.4.109, 3.18.91 and 3.16.52 when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system.

AVG-574 linux-hardened 4.14.7.a-1 4.14.11.a-1 High Fixed FS#56832

AVG-571 linux-zen 4.14.7-1 4.14.11-1 High Fixed FS#56832

AVG-561 linux-lts 4.9.68-1 4.9.74-1 High Fixed

AVG-552 linux 4.14.7-1 4.14.11-1 High Fixed FS#56832

05 Jan 2018 ASA-201801-4 AVG-574 linux-hardened High multiple issues

05 Jan 2018 ASA-201801-3 AVG-571 linux-zen High multiple issues

05 Jan 2018 ASA-201801-2 AVG-561 linux-lts High multiple issues

05 Jan 2018 ASA-201801-1 AVG-552 linux High multiple issues

https://git.kernel.org/linus/93c647643b48f0131f02e45da3bd367d80443291