Bug 1209902 (CVE-2015-2924)

Summary: CVE-2015-2924 NetworkManager: denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bgalvani, danw, dcbw, fweimer, jklimes, jrusnack, lrintel, psimerda, rkhan, spider, thaller
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A flaw was found in the way NetworkManager handled router advertisements. An unprivileged user on a local network could use IPv6 Neighbor Discovery ICMP to broadcast a non-route with a low hop limit, causing machines to lower the hop limit on existing IPv6 routes. If this limit is small enough, IPv6 packets would be dropped before reaching the final destination.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2015-11-20 05:18:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1209903, 1217090    
Bug Blocks: 1209904, 1210268    
Attachments:
Description Flags
patch only to increase (not decrease) the hop-limit none

Description Vasyl Kaigorodov 2015-04-08 12:39:48 UTC 
This issue is similar to CVE-2015-2922 (bug 1203712).
This might refer to the code below:

http://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/src/rdisc/nm-lndp-rdisc.c
...
  hop_limit = ndp_msgra_curhoplimit (msgra);
  if (rdisc->hop_limit != hop_limit) {
          rdisc->hop_limit = hop_limit;
          changed |= NM_RDISC_CONFIG_HOP_LIMIT;
...

CVE was assigned here: http://seclists.org/oss-sec/2015/q2/46
Comment 1 Vasyl Kaigorodov 2015-04-08 12:40:17 UTC 
Created NetworkManager tracking bugs for this issue:

Affects: fedora-all [bug 1209903]
Comment 3 Thomas Haller 2015-04-08 15:58:34 UTC 
Created attachment 1012277 [details]
patch only to increase (not decrease) the hop-limit
Comment 4 Lubomir Rintel 2015-04-22 14:26:38 UTC 
-	/* don't allow unreasonable small values */
+	/* don't allow unreasonably small values */

LGTM
Comment 5 Beniamino Galvani 2015-04-29 09:56:29 UTC 
On current master the patch needs to be rebased after 2316d233e36d, anyway looks OK to me.
Comment 6 Thomas Haller 2015-04-29 12:30:15 UTC 
merged to

master: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=bdaaf9849b0cacf131b71fa2ae168f5db796874f

nm-1-0: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=6e8c5b51b16c6a60a533ce753bcc54b7e2e703ca
Comment 8 Thomas Haller 2015-04-29 14:16:16 UTC 
(In reply to Thomas Haller from comment #6)
> merged to
> 
> master:
> http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/
> ?id=bdaaf9849b0cacf131b71fa2ae168f5db796874f
> 
> nm-1-0:
> http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/
> ?id=6e8c5b51b16c6a60a533ce753bcc54b7e2e703ca

and nm-0-9-10: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=d195edb95a543f7eebbd0a164e8ff3bef599370a


This issue doesn't affect NetworkManager on RHEL-6, as NM on RHEL-6 doesn't do RA/SLAAC in userspace.
Comment 9 Fedora Update System 2015-05-11 19:04:31 UTC 
NetworkManager-1.0.2-1.fc22, NetworkManager-openconnect-1.0.2-1.fc22, NetworkManager-vpnc-1.0.2-1.fc22, network-manager-applet-1.0.2-1.fc22, NetworkManager-openvpn-1.0.2-1.fc22, NetworkManager-openswan-1.0.2-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2015-05-17 06:42:26 UTC 
NetworkManager-0.9.10.2-5.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Dan Williams 2015-10-30 14:52:42 UTC 
*** Bug 1199276 has been marked as a duplicate of this bug. ***
Comment 12 errata-xmlrpc 2015-11-19 11:01:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2315 https://rhn.redhat.com/errata/RHSA-2015-2315.html