> What I am missing is if any other conditions need to be met for a suser > to exploit this. I'd presume that the user needs to be able to run > their own network namespace. Or does it even work without it? No extra > privileges of any kind needed?
The exploit does not require CAP_NET_ADMIN, but it does require CAP_NET_RAW to construct the malicious packet. A separate network namespace is not strictly required. Docker grants CAP_NET_RAW by default, and the exploit works from inside a container and results in container escape. So, for the known exploit paths, either CAP_NET_ADMIN or CAP_NET_RAW is sufficient. Fourier
