Bug 2447265
| Summary: | CVE-2026-4105 NetworkManager: systemd: Privilege escalation via improper access control in RegisterMachine D-Bus method [fedora-all] | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Abhishek Raj <abhraj> |
| Component: | NetworkManager | Assignee: | Lubomir Rintel <lkundrak> |
| Status: | NEW --- | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 45 | CC: | bgalvani, ffmancera, ihuguet, jvaclav, lkundrak, mclasen, opensource, rstrode, vbenes |
| Target Milestone: | --- | Keywords: | Security, SecurityTracking |
| Target Release: | --- | Flags: | ihuguet:
needinfo?
(abhraj) |
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | {"flaws": ["a3a049fa-f193-49a4-a9c9-e0d1863e6535"]} | ||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2447262 | ||
|
Description
Abhishek Raj
2026-03-13 08:39:51 UTC
I fail to understand how this can be related to NetworkManager. It seems to be a bug in systemd-machined. Abhishek, I am missing something? (In reply to Íñigo Huguet from comment #1) > I fail to understand how this can be related to NetworkManager. It seems to > be a bug in systemd-machined. Abhishek, I am missing something? I guess it's because the spec file of NM contains: # NetworkManager uses various parts of systemd-networkd internally, including # DHCP client, IPv4 Link-Local address negotiation or LLDP support. # This provide is essentially here so that NetworkManager shows on Security # Response Team's radar in case a flaw is found. The code is frequently # synchronized and thus it's not easy to establish a good version number # here. The version of zero is there just to have something conservative so # that the scripts that would parse the SPEC file naively would be unlikely # to fail. Refer to git log for the real date and commit number of last # synchronization: # https://gitlab.freedesktop.org/NetworkManager/NetworkManager/commits/main/src/ Provides: bundled(systemd) = 0 This specific vulnerability doesn't seem to impact NM. If that's the reason, the I agree with Beniamino. The part of systemd that NM uses is only about DHCPv6. No code from machined is used. This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45. |