Linux kernel (net/xfrm, net/key): No memory corruption here, but a clean namespace boundary break. SA migration

Impact

No memory corruption here, but a clean namespace boundary break. SA migration notifications were multicast to the init namespace regardless of which namespace issued them, so a migration triggered inside a tenant namespace is delivered to the host's IKE daemon as if it were the host's own event - carrying an attacker-chosen selector and new endpoint address. A tenant can therefore feed the host key-management daemon a forged MOBIKE-style address update, and in the other direction a tenant's own daemon never sees its migrations, so address updates inside a namespace silently do not work. Both halves mean fabric encryption ends up pointed at an endpoint someone else chose.

Who can reach it

A tenant container with CAP_NET_ADMIN in its own user+network namespace issues XFRM_MSG_MIGRATE (or the PF_KEY equivalent) on its own namespace's socket; the notification is delivered to XFRMNLGRP_MIGRATE and PF_KEY listeners in the init namespace, i.e. to the host's IKE daemon. Exploitability depends on whether that daemon acts on migrate notifications without re-validating the originating namespace - most do not check, because until this fix the notification could only come from init_net. No fabric access needed.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: do not run a host IKE daemon subscribed to XFRMNLGRP_MIGRATE or PF_KEY BROADCAST_ALL on nodes where tenants hold CAP_NET_ADMIN in their own namespaces, and remove that capability from tenant namespaces.

References