Bug 1209902 (CVE-2015-2924) - CVE-2015-2924 NetworkManager: denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements
Summary: CVE-2015-2924 NetworkManager: denial of service (DoS) attack against IPv6 net...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-2924
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1199276 (view as bug list)
Depends On: 1209903 1217090
Blocks: 1209904 1210268
TreeView+ depends on / blocked
 
Reported: 2015-04-08 12:39 UTC by Vasyl Kaigorodov
Modified: 2019-09-29 13:31 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way NetworkManager handled router advertisements. An unprivileged user on a local network could use IPv6 Neighbor Discovery ICMP to broadcast a non-route with a low hop limit, causing machines to lower the hop limit on existing IPv6 routes. If this limit is small enough, IPv6 packets would be dropped before reaching the final destination.
Clone Of:
Environment:
Last Closed: 2015-11-20 05:18:55 UTC
Embargoed:

Attachments (Terms of Use)
patch only to increase (not decrease) the hop-limit (4.05 KB, patch)
2015-04-08 15:58 UTC, Thomas Haller 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2315 0 normal SHIPPED_LIVE Moderate: NetworkManager security, bug fix, and enhancement update 2015-11-19 10:06:58 UTC

Description Vasyl Kaigorodov 2015-04-08 12:39:48 UTC 
This issue is similar to CVE-2015-2922 (bug 1203712).
This might refer to the code below:

http://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/src/rdisc/nm-lndp-rdisc.c
...
  hop_limit = ndp_msgra_curhoplimit (msgra);
  if (rdisc->hop_limit != hop_limit) {
          rdisc->hop_limit = hop_limit;
          changed |= NM_RDISC_CONFIG_HOP_LIMIT;
...

CVE was assigned here: http://seclists.org/oss-sec/2015/q2/46
Comment 1 Vasyl Kaigorodov 2015-04-08 12:40:17 UTC 
Created NetworkManager tracking bugs for this issue:

Affects: fedora-all [bug 1209903]
Comment 3 Thomas Haller 2015-04-08 15:58:34 UTC 
Created attachment 1012277 [details]
patch only to increase (not decrease) the hop-limit
Comment 4 Lubomir Rintel 2015-04-22 14:26:38 UTC 
-	/* don't allow unreasonable small values */
+	/* don't allow unreasonably small values */

LGTM
Comment 5 Beniamino Galvani 2015-04-29 09:56:29 UTC 
On current master the patch needs to be rebased after 2316d233e36d, anyway looks OK to me.
Comment 6 Thomas Haller 2015-04-29 12:30:15 UTC 
merged to

master: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=bdaaf9849b0cacf131b71fa2ae168f5db796874f

nm-1-0: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=6e8c5b51b16c6a60a533ce753bcc54b7e2e703ca
Comment 8 Thomas Haller 2015-04-29 14:16:16 UTC 
(In reply to Thomas Haller from comment #6)
> merged to
> 
> master:
> http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/
> ?id=bdaaf9849b0cacf131b71fa2ae168f5db796874f
> 
> nm-1-0:
> http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/
> ?id=6e8c5b51b16c6a60a533ce753bcc54b7e2e703ca

and nm-0-9-10: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=d195edb95a543f7eebbd0a164e8ff3bef599370a


This issue doesn't affect NetworkManager on RHEL-6, as NM on RHEL-6 doesn't do RA/SLAAC in userspace.
Comment 9 Fedora Update System 2015-05-11 19:04:31 UTC 
NetworkManager-1.0.2-1.fc22, NetworkManager-openconnect-1.0.2-1.fc22, NetworkManager-vpnc-1.0.2-1.fc22, network-manager-applet-1.0.2-1.fc22, NetworkManager-openvpn-1.0.2-1.fc22, NetworkManager-openswan-1.0.2-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2015-05-17 06:42:26 UTC 
NetworkManager-0.9.10.2-5.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Dan Williams 2015-10-30 14:52:42 UTC 
*** Bug 1199276 has been marked as a duplicate of this bug. ***
Comment 12 errata-xmlrpc 2015-11-19 11:01:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2315 https://rhn.redhat.com/errata/RHSA-2015-2315.html
Note You need to log in before you can comment on or make changes to this bug.