Bug 1558238 (CVE-2018-1000135) - CVE-2018-1000135 NetworkManager: Information exposure in DNS resolver
Summary: CVE-2018-1000135 NetworkManager: Information exposure in DNS resolver
Alias: CVE-2018-1000135
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1558608 1576490 1576776
Blocks: 1558239
TreeView+ depends on / blocked
Reported: 2018-03-19 21:07 UTC by Pedro Sampaio
Modified: 2021-10-21 19:58 UTC (History)
17 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An information exposure vulnerability has been found in NetworkManager when dnsmasq is used in DNS processing mode. An attacker in control of a DNS server could receive DNS queries even though a Virtual Private Network (VPN) was configured on the vulnerable machine.
Clone Of:
Last Closed: 2021-10-21 19:58:16 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
GNOME Bugzilla 746422 0 Normal RESOLVED [CVE-2018-1000135] Unencrypted DNS queries leaked outside full-tunnel VPN 2020-12-08 20:38:04 UTC

Description Pedro Sampaio 2018-03-19 21:07:29 UTC
GNOME NetworkManager version 1.10.6 and earlier, when used with dns dnsmasq
plugin, contains a information exposure vulnerability in DNS resolver that can
result in Private DNS queries leaked to local network's DNS servers, while on
VPN. This vulnerability appears to have been fixed in some Ubuntu 16.04
packages, but later updates removed the fix.


Comment 1 Adam Mariš 2018-03-20 15:33:50 UTC
Created NetworkManager tracking bugs for this issue:

Affects: fedora-all [bug 1558608]

Comment 3 Riccardo Schirone 2018-05-10 09:30:35 UTC
Ongoing effort to create a patch:

Comment 6 Riccardo Schirone 2018-05-10 12:31:01 UTC

We suggest to keep the default `dns=default` in the NetworkManager configuration file to prevent DNS queries leaks to possibly hostile DNS servers.

Comment 7 Riccardo Schirone 2018-05-10 12:36:11 UTC
On RHEL 7 and Fedora, `dns=default` is used by default, which is not vulnerable to this problem, since it does not use "split DNS".

Comment 8 Riccardo Schirone 2018-05-10 12:37:31 UTC

This issue did not affect the versions of NetworkManager as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for dnsmasq DNS resolver.

Comment 9 David Woodhouse 2020-09-09 10:04:49 UTC
(In reply to Riccardo Schirone from comment #7)
> On RHEL 7 and Fedora, `dns=default` is used by default, which is not
> vulnerable to this problem, since it does not use "split DNS".

Please note discussion in https://bugzilla.redhat.com/show_bug.cgi?id=1863041

Let's make sure we don't introduce this vulnerability in Fedora as we enable split DNS via systemd-resolved.

VPNs by default should use the VPN DNS for *all* lookups unless explicitly configured otherwise.

Note You need to log in before you can comment on or make changes to this bug.