Bug 1558238 – CVE-2018-1000135 NetworkManager: Information exposure in DNS resolver

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1558238 - (CVE-2018-1000135) CVE-2018-1000135 NetworkManager: Information exposure in DNS resolver

Summary:	CVE-2018-1000135 NetworkManager: Information exposure in DNS resolver

Status:	NEW

Aliases:	CVE-2018-1000135

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20180320,repor...
Keywords:	Security

Depends On:	1558608 1576490 1576776
Blocks:	1558239
	Show dependency tree / graph

Reported:	2018-03-19 17:07 EDT by Pedro Sampaio
Modified:	2018-05-14 17:22 EDT (History)
CC List:	17 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	An information exposure vulnerability has been found in NetworkManager when dnsmasq is used in DNS processing mode. An attacker in control of a DNS server could receive DNS queries even though a Virtual Private Network (VPN) was configured on the vulnerable machine.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
GNOME Bugzilla	746422	None	None	None	2018-03-20 12:13 EDT

Groups: None (edit)

Description Pedro Sampaio 2018-03-19 17:07:29 EDT

GNOME NetworkManager version 1.10.6 and earlier, when used with dns dnsmasq
plugin, contains a information exposure vulnerability in DNS resolver that can
result in Private DNS queries leaked to local network's DNS servers, while on
VPN. This vulnerability appears to have been fixed in some Ubuntu 16.04
packages, but later updates removed the fix.

References:
https://bugs.launchpad.net/ubuntu/+bug/1754671
https://bugzilla.redhat.com/show_bug.cgi?id=1553634

Comment 1 Adam Mariš 2018-03-20 11:33:50 EDT

Created NetworkManager tracking bugs for this issue:

Affects: fedora-all [bug 1558608]

Comment 3 Riccardo Schirone 2018-05-10 05:30:35 EDT

Ongoing effort to create a patch:
https://bugzilla.gnome.org/show_bug.cgi?id=746422

Comment 6 Riccardo Schirone 2018-05-10 08:31:01 EDT

Mitigation:

We suggest to keep the default `dns=default` in the NetworkManager configuration file to prevent DNS queries leaks to possibly hostile DNS servers.

Comment 7 Riccardo Schirone 2018-05-10 08:36:11 EDT

On RHEL 7 and Fedora, `dns=default` is used by default, which is not vulnerable to this problem, since it does not use "split DNS".

Comment 8 Riccardo Schirone 2018-05-10 08:37:31 EDT

Statement:

This issue did not affect the versions of NetworkManager as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for dnsmasq DNS resolver.

Note You need to log in before you can comment on or make changes to this bug.