CVE-2023-1076 Information

Description

A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct as tuntap devices require CAP_NET_ADMIN it may not always be the case e.g. a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions possibly bypassing network filters.

Reference

https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a