Bug 2284122 (CVE-2024-5564) - CVE-2024-5564 libndp: buffer overflow in route information length field [NEEDINFO]
Summary: CVE-2024-5564 libndp: buffer overflow in route information length field
Keywords:
Status: NEW
Alias: CVE-2024-5564
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2291319
Blocks: 2284118
TreeView+ depends on / blocked
 
Reported: 2024-05-31 13:38 UTC by Patrick Del Bello
Modified: 2024-10-10 13:41 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:
fmaurer: needinfo? (pdelbell)

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:4618 0 None None None 2024-07-18 13:19:34 UTC
Red Hat Product Errata RHSA-2024:4619 0 None None None 2024-07-18 13:16:32 UTC
Red Hat Product Errata RHSA-2024:4620 0 None None None 2024-07-18 13:59:26 UTC
Red Hat Product Errata RHSA-2024:4622 0 None None None 2024-07-18 13:34:55 UTC
Red Hat Product Errata RHSA-2024:4636 0 None None None 2024-07-18 15:38:12 UTC
Red Hat Product Errata RHSA-2024:4640 0 None None None 2024-07-18 15:44:06 UTC
Red Hat Product Errata RHSA-2024:4641 0 None None None 2024-07-18 16:27:09 UTC
Red Hat Product Errata RHSA-2024:4642 0 None None None 2024-07-19 10:20:06 UTC
Red Hat Product Errata RHSA-2024:4643 0 None None None 2024-07-18 16:21:42 UTC

Description Patrick Del Bello 2024-05-31 13:38:29 UTC 
A vulnerability was found in libndp. A buffer overflow in NetworkManager that can be triggered by sending a malformed IPv6 router advertisement packet via malicious user locally.  This happens as libndp was not validating correctly the route length information and hence leading to a flaw. This affects versions of libndp >= 1.0.
Comment 2 Dhananjay Arunesh 2024-06-11 13:03:14 UTC 
Created libndp tracking bugs for this issue:

Affects: fedora-all [bug 2291319]
Comment 7 errata-xmlrpc 2024-07-18 13:16:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:4619 https://access.redhat.com/errata/RHSA-2024:4619
Comment 8 errata-xmlrpc 2024-07-18 13:19:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:4618 https://access.redhat.com/errata/RHSA-2024:4618
Comment 9 errata-xmlrpc 2024-07-18 13:34:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2024:4622 https://access.redhat.com/errata/RHSA-2024:4622
Comment 10 errata-xmlrpc 2024-07-18 13:59:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:4620 https://access.redhat.com/errata/RHSA-2024:4620
Comment 11 errata-xmlrpc 2024-07-18 15:38:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4636 https://access.redhat.com/errata/RHSA-2024:4636
Comment 12 errata-xmlrpc 2024-07-18 15:44:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2024:4640 https://access.redhat.com/errata/RHSA-2024:4640
Comment 13 errata-xmlrpc 2024-07-18 16:21:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:4643 https://access.redhat.com/errata/RHSA-2024:4643
Comment 14 errata-xmlrpc 2024-07-18 16:27:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:4641 https://access.redhat.com/errata/RHSA-2024:4641
Comment 15 errata-xmlrpc 2024-07-19 10:20:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:4642 https://access.redhat.com/errata/RHSA-2024:4642
Note You need to log in before you can comment on or make changes to this bug.