Bug 1209902 (CVE-2015-2924) - CVE-2015-2924 NetworkManager: denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements
Summary: CVE-2015-2924 NetworkManager: denial of service (DoS) attack against IPv6 net...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-2924
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1199276 (view as bug list)
Depends On: 1209903 1217090
Blocks: 1209904 1210268
TreeView+ depends on / blocked
 
Reported: 2015-04-08 12:39 UTC by Vasyl Kaigorodov
Modified: 2019-09-29 13:31 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2015-11-20 05:18:55 UTC
Embargoed:

Attachments (Terms of Use)
patch only to increase (not decrease) the hop-limit (4.05 KB, patch)
2015-04-08 15:58 UTC, Thomas Haller 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2315 0 normal SHIPPED_LIVE Moderate: NetworkManager security, bug fix, and enhancement update 2015-11-19 10:06:58 UTC

Description Vasyl Kaigorodov 2015-04-08 12:39:48 UTC 
This issue is similar to CVE-2015-2922 (bug 1203712).
This might refer to the code below:

http://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/src/rdisc/nm-lndp-rdisc.c
...
  hop_limit = ndp_msgra_curhoplimit (msgra);
  if (rdisc->hop_limit != hop_limit) {
          rdisc->hop_limit = hop_limit;
          changed |= NM_RDISC_CONFIG_HOP_LIMIT;
...

CVE was assigned here: http://seclists.org/oss-sec/2015/q2/46
Comment 1 Vasyl Kaigorodov 2015-04-08 12:40:17 UTC 
Created NetworkManager tracking bugs for this issue:

Affects: fedora-all [bug 1209903]
Comment 3 Thomas Haller 2015-04-08 15:58:34 UTC 
Created attachment 1012277 [details]
patch only to increase (not decrease) the hop-limit
Comment 4 Lubomir Rintel 2015-04-22 14:26:38 UTC 
-	/* don't allow unreasonable small values */
+	/* don't allow unreasonably small values */

LGTM
Comment 5 Beniamino Galvani 2015-04-29 09:56:29 UTC 
On current master the patch needs to be rebased after 2316d233e36d, anyway looks OK to me.
Comment 6 Thomas Haller 2015-04-29 12:30:15 UTC 
merged to

master: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=bdaaf9849b0cacf131b71fa2ae168f5db796874f

nm-1-0: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=6e8c5b51b16c6a60a533ce753bcc54b7e2e703ca
Comment 8 Thomas Haller 2015-04-29 14:16:16 UTC 
(In reply to Thomas Haller from comment #6)
> merged to
> 
> master:
> http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/
> ?id=bdaaf9849b0cacf131b71fa2ae168f5db796874f
> 
> nm-1-0:
> http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/
> ?id=6e8c5b51b16c6a60a533ce753bcc54b7e2e703ca

and nm-0-9-10: http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=d195edb95a543f7eebbd0a164e8ff3bef599370a


This issue doesn't affect NetworkManager on RHEL-6, as NM on RHEL-6 doesn't do RA/SLAAC in userspace.
Comment 9 Fedora Update System 2015-05-11 19:04:31 UTC 
NetworkManager-1.0.2-1.fc22, NetworkManager-openconnect-1.0.2-1.fc22, NetworkManager-vpnc-1.0.2-1.fc22, network-manager-applet-1.0.2-1.fc22, NetworkManager-openvpn-1.0.2-1.fc22, NetworkManager-openswan-1.0.2-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2015-05-17 06:42:26 UTC 
NetworkManager-0.9.10.2-5.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Dan Williams 2015-10-30 14:52:42 UTC 
*** Bug 1199276 has been marked as a duplicate of this bug. ***
Comment 12 errata-xmlrpc 2015-11-19 11:01:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2315 https://rhn.redhat.com/errata/RHSA-2015-2315.html
Note You need to log in before you can comment on or make changes to this bug.