CVE-2017-17449

What it actually does

The __netlink_deliver_tap_skb function fails to enforce net namespace boundaries for nlmon interfaces when CONFIG_NLMON is enabled, allowing a process holding CAP_NET_ADMIN to observe all Netlink messages system-wide.

Why it matters to the business

Attackers with limited local access can read sensitive network configuration, routing, and management traffic that should remain isolated between containers or network namespaces, increasing the chance of credential or topology exposure in multi-tenant Linux environments.

How an attack unfolds

An attacker obtains CAP_NET_ADMIN, creates or attaches to an nlmon interface, and reads every Netlink datagram delivered by the kernel regardless of originating namespace, thereby harvesting system-wide information without triggering cross-namespace access controls.

How to fix it

Upgrade the Linux kernel to a version containing the fix for net/netlink/af_netlink.c that restricts nlmon observations to a single namespace; rebuild and reboot affected systems. Where immediate patching is impossible, disable CONFIG_NLMON at build time or restrict the capability via SELinux/AppArmor policies.

How to confirm the fix worked

After patching, create multiple network namespaces, generate Netlink activity in each, attach an nlmon interface, and confirm that only messages from the interface's own namespace are observed.

Typical attack path

1. Obtain or escalate to a process with CAP_NET_ADMIN
2. Create or open an nlmon interface
3. Read raw Netlink messages from the tap
4. Parse captured messages for sensitive data such as routes, addresses, or firewall rules

How to detect it

Search system logs and audit trails for nlmon interface creation, netlink socket opens by non-root or unexpected processes, and unusual CAP_NET_ADMIN usage; correlate with process execution of tools that attach to packet sockets.

What your security team should do

• Prioritize kernel updates on all systems exposing nlmon or running containers
• Audit and minimize processes granted CAP_NET_ADMIN
• Add runtime policies that block creation of nlmon interfaces except by approved monitoring tools