A report from e-mail:

> -------- Forwarded Message --------
> From: Julien BERNARD <julien.bernard@viagenie.ca>
> To: Dan Williams <dcbw@redhat.com>, Tambet Ingo <tambet@gmail.com>
> Cc: secalert@redhat.com, Viagénie Engineering <eng@viagenie.ca>
> Subject: Security issue with IPv6 on NetworkManager
> Date: Wed, 20 Apr 2016 12:56:36 -0400
>
> Hi,
>
> We didn't want to report this in the bug tracker regarding the security
> implications.
>
> We believe that NetworkManager accepts and process Router
> Advertisements
> with Hop Limit lesser than 255 allowing any node that is not on the
> local link to advertise as a router.
> This can be used to perform DoS attacks or to intercept/modify traffic
> of hosts outside of the local link.
>
> This was tested on lab and we managed to reproduce it at any time.
> Looking at the source code, checking the hop-limit value in the
> receive_ra function  in src/rdisc/nm-lndp-rdisc.c file should resolve
> the issue.
>
> See RFC4861 §6.1.2 Validation of Router Advertisement Messages and §11
> for Security Considerations section.
>
>
> Best regards,
>
> Julien Bernard

I belive the bug is actually a bug in libndp, not NetworkManager. However, it affects NetworkManager >= 1.0; that is all supported versions of Fedora and RHEL-7 (RHEL-6 is not affected, since NM doesn't do IPv6 RA in userspace there).

We've added additional flaw that libndp doesn't validate that the source address of the RA messages is a link-local address, making it easier to exploit this.

The issue is not public and we probably need to coordinate the disclosure.