Linux VXLAN driver (CAP_NET_ADMIN check on changelink across netns): TENANT ISOLATION: a VXLAN tunnel's `changelink()`

Impact

TENANT ISOLATION: a VXLAN tunnel's changelink() operates across two network namespaces — the device's namespace and the sticky underlay namespace — but the capability check only covers the device's. Once a VXLAN device has been created in or moved to a different namespace, a caller with CAP_NET_ADMIN in only one of them can reconfigure the tunnel's underlay side. In a container platform, network namespaces are the tenant boundary and CAP_NET_ADMIN inside a namespace is something you grant routinely; this turns namespace-local privilege into control over the underlay encapsulation that other tenants share.

Who can reach it

A container or tenant holding CAP_NET_ADMIN in its own network namespace, against a VXLAN device whose underlay namespace differs from its device namespace.

What to do

Kernel upgrade plus host reboot across container hosts. Interim: do not grant CAP_NET_ADMIN to tenant containers — a container-runtime policy change and one of the highest-value single restrictions available on a shared GPU host, since it also closes a long tail of similar netlink-reachable issues.

References