Bug 1558238 (CVE-2018-1000135)

Summary:	CVE-2018-1000135 NetworkManager: Information exposure in DNS resolver
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alexl, atragler, bgalvani, dcbw, dwmw2, fgiudici, john.j5live, lkundrak, lrintel, mclasen, rhughes, rkhan, rschiron, rstrode, security-response-team, sukulkar, thaller
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An information exposure vulnerability has been found in NetworkManager when dnsmasq is used in DNS processing mode. An attacker in control of a DNS server could receive DNS queries even though a Virtual Private Network (VPN) was configured on the vulnerable machine.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 19:58:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1558608, 1576490, 1576776
Bug Blocks:	1558239

Description Pedro Sampaio 2018-03-19 21:07:29 UTC

GNOME NetworkManager version 1.10.6 and earlier, when used with dns dnsmasq
plugin, contains a information exposure vulnerability in DNS resolver that can
result in Private DNS queries leaked to local network's DNS servers, while on
VPN. This vulnerability appears to have been fixed in some Ubuntu 16.04
packages, but later updates removed the fix.

References:
https://bugs.launchpad.net/ubuntu/+bug/1754671
https://bugzilla.redhat.com/show_bug.cgi?id=1553634

Comment 1 Adam Mariš 2018-03-20 15:33:50 UTC

Created NetworkManager tracking bugs for this issue:

Affects: fedora-all [bug 1558608]

Comment 3 Riccardo Schirone 2018-05-10 09:30:35 UTC

Ongoing effort to create a patch:
https://bugzilla.gnome.org/show_bug.cgi?id=746422

Comment 6 Riccardo Schirone 2018-05-10 12:31:01 UTC

Mitigation:

We suggest to keep the default `dns=default` in the NetworkManager configuration file to prevent DNS queries leaks to possibly hostile DNS servers.

Comment 7 Riccardo Schirone 2018-05-10 12:36:11 UTC

On RHEL 7 and Fedora, `dns=default` is used by default, which is not vulnerable to this problem, since it does not use "split DNS".

Comment 8 Riccardo Schirone 2018-05-10 12:37:31 UTC

Statement:

This issue did not affect the versions of NetworkManager as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for dnsmasq DNS resolver.

Comment 9 David Woodhouse 2020-09-09 10:04:49 UTC

(In reply to Riccardo Schirone from comment #7)
> On RHEL 7 and Fedora, `dns=default` is used by default, which is not
> vulnerable to this problem, since it does not use "split DNS".

Please note discussion in https://bugzilla.redhat.com/show_bug.cgi?id=1863041

Let's make sure we don't introduce this vulnerability in Fedora as we enable split DNS via systemd-resolved.

VPNs by default should use the VPN DNS for *all* lookups unless explicitly configured otherwise.