[PATCH] ieee802154: require CAP_NET_ADMIN for SIOCSIFADDR

[PATCH] ieee802154: require CAP_NET_ADMIN for SIOCSIFADDR

[Sung Byeongchan]

PF_IEEE802154 DGRAM sockets are available to ordinary init-net processes.
Their family-specific SIOCSIFADDR path calls the netdev ioctl directly and
does not pass through the generic network-device setter capability check.
An unprivileged process can therefore change the PAN ID and short address
of a separately administrator-owned down WPAN interface.

In a local fakelb fixture, uid 1000 changed both identifiers and the values
remained active through a later administrator interface open in three of
three fresh KASAN boots.

Require CAP_NET_ADMIN in the socket network namespace before processing
SIOCSIFADDR. Keep SIOCGIFADDR and all existing state and value checks
unchanged.

The fixed kernel rejected the same unprivileged request with -EPERM and
preserved the administrator identity in three of three matched boots.
Administrator SET, running-device, invalid-value, wrong-device, cleanup,
later-open and recovery controls passed in all baseline and fixed runs.

The demonstrated impact is local cross-principal WPAN identity and policy
modification after privileged device setup. Memory corruption, disclosure,
RCE and LPE were not demonstrated.

Fixes: 9ec767160357 ("net: add IEEE 802.15.4 socket family implementation")
Assisted-by: OpenAI Codex

Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
---
 net/ieee802154/socket.c |    4 ++++
 1 file changed, 4 insertions(+)
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index be8ca1f053a2b..362457de8424c 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -128,6 +128,10 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
 	int ret = -ENOIOCTLCMD;
 	struct net_device *dev;
 
+	if (cmd == SIOCSIFADDR &&
+	    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+		return -EPERM;
+
 	if (get_user_ifreq(&ifr, NULL, arg))
 		return -EFAULT;
 

base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
-- 
2.43.0

Re: [PATCH] ieee802154: require CAP_NET_ADMIN for SIOCSIFADDR

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.