Post #2707392
2026-05-08 00:11 UTC
@hailey@hails.org That's what I said. You need a way to setup the network interfaces to exploit this, but it's fundamental that, if you can setup virtual network interfaces as a user, you can exploit this. The fact that AF_NETLINK is the mechanism by which you set them up isn't particularly important.
Yes, you could cut off access to this one by preventing users from doing that, in a number of ways. Blocking netlink is just one. You could also nuke user namespaces. But now all sorts of stuff which in principle shouldn't be privileged needs suids, opening up net attack surface...
Note that killing AF_NETLINK would break some libc interfaces applications might use, including at least mq_notify, getifaddrs, if_nameindex.
Replies (2)
-
@dalias@hachyderm.io 2026-05-08 00:13
@hailey@hails.org If I wanted a big hammer to cut off this whole class of vuln without impacting important functionality, though, I'd just setup a global seccomp filter to block SYS_splice and related syscalls, or patch them out of the syscall table.
-
@navi@social.vlhl.dev 2026-05-08 00:16
@dalias@hachyderm.io @hailey@hails.org killing AF_NETLINK would also kill uevents for udev which matters less on servers i suppose but i have no idea how systemd systems would react to that