Bug 1558238 (CVE-2018-1000135) - CVE-2018-1000135 NetworkManager: Information exposure in DNS resolver
Summary: CVE-2018-1000135 NetworkManager: Information exposure in DNS resolver
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-1000135
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1558608 1576490 1576776
Blocks: 1558239
TreeView+ depends on / blocked
 
Reported: 2018-03-19 21:07 UTC by Pedro Sampaio
Modified: 2021-10-21 19:58 UTC (History)
17 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An information exposure vulnerability has been found in NetworkManager when dnsmasq is used in DNS processing mode. An attacker in control of a DNS server could receive DNS queries even though a Virtual Private Network (VPN) was configured on the vulnerable machine.
Clone Of:
Environment:
Last Closed: 2021-10-21 19:58:16 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
GNOME Bugzilla 746422 0 Normal RESOLVED [CVE-2018-1000135] Unencrypted DNS queries leaked outside full-tunnel VPN 2020-12-08 20:38:04 UTC

Description Pedro Sampaio 2018-03-19 21:07:29 UTC 
GNOME NetworkManager version 1.10.6 and earlier, when used with dns dnsmasq
plugin, contains a information exposure vulnerability in DNS resolver that can
result in Private DNS queries leaked to local network's DNS servers, while on
VPN. This vulnerability appears to have been fixed in some Ubuntu 16.04
packages, but later updates removed the fix.

References:
https://bugs.launchpad.net/ubuntu/+bug/1754671
https://bugzilla.redhat.com/show_bug.cgi?id=1553634
Comment 1 Adam Mariš 2018-03-20 15:33:50 UTC 
Created NetworkManager tracking bugs for this issue:

Affects: fedora-all [bug 1558608]
Comment 3 Riccardo Schirone 2018-05-10 09:30:35 UTC 
Ongoing effort to create a patch:
https://bugzilla.gnome.org/show_bug.cgi?id=746422
Comment 6 Riccardo Schirone 2018-05-10 12:31:01 UTC 
Mitigation:

We suggest to keep the default `dns=default` in the NetworkManager configuration file to prevent DNS queries leaks to possibly hostile DNS servers.
Comment 7 Riccardo Schirone 2018-05-10 12:36:11 UTC 
On RHEL 7 and Fedora, `dns=default` is used by default, which is not vulnerable to this problem, since it does not use "split DNS".
Comment 8 Riccardo Schirone 2018-05-10 12:37:31 UTC 
Statement:

This issue did not affect the versions of NetworkManager as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for dnsmasq DNS resolver.
Comment 9 David Woodhouse 2020-09-09 10:04:49 UTC 
(In reply to Riccardo Schirone from comment #7)
> On RHEL 7 and Fedora, `dns=default` is used by default, which is not
> vulnerable to this problem, since it does not use "split DNS".

Please note discussion in https://bugzilla.redhat.com/show_bug.cgi?id=1863041

Let's make sure we don't introduce this vulnerability in Fedora as we enable split DNS via systemd-resolved.

VPNs by default should use the VPN DNS for *all* lookups unless explicitly configured otherwise.
Note You need to log in before you can comment on or make changes to this bug.