Post #2707391

2026-05-07 23:49 UTC

@dalias@hachyderm.io hold up, I see the iproute2 shell out. I disagree, I think AF_NETLINK is quite relevant. If you block that address family, you block the exploit. Most programs have no need for that address family, so it's unnecessary exposure. I'll revise my position when I see a poc which does not use AF_NETLINK

Replies (2)

@dalias@hachyderm.io 2026-05-08 00:11

@hailey@hails.org That's what I said. You need a way to setup the network interfaces to exploit this, but it's fundamental that, if you can setup virtual network interfaces as a user, you can exploit this. The fact that AF_NETLINK is the mechanism by which you set them up isn't particularly important. Yes, you could cut off access to this one by preventing users from doing that, in a number of ways. Blocking netlink is just one. You could also nuke user namespaces. But now all sorts of stuff which in principle shouldn't be privileged needs suids, opening up net attack surface... Note that killing AF_NETLINK would break some libc interfaces applications might use, including at least mq_notify, getifaddrs, if_nameindex.

Open ##2707392
@mirabilos@toot.mirbsd.org 2026-05-08 01:09

@hailey@hails.org @dalias@hachyderm.io yes, AF_NETLINK is used by ip, you don’t want to break that. The actual route is via IPsec and another via an obscure RPC protocol. (AF_ALG is also still suspect.)

Open ##2707404