set_interface_var() doesn't check interface name and blindly does
fopen(path "/" ifname, "w") on it.  As "ifname" is an untrusted input, it
should be checked for ".." and/or "/" in it.  Otherwise, an infected
unprivileged daemon may overwrite contents of file named "mtu",
"hoplimit", etc. in arbitrary location with arbitrary 32-bit value in
decimal representation ("%d").  If an attacker has a local account or
may create arbitrary symlinks with these names in any location (e.g.
/tmp), any file may be overwritten with a decimal value.