libndpの脆弱性でバッファオーバーフローが起き、ローカルから悪用されるおそれ
Summary
2024年5月31日に公表された、libndpのバッファオーバーフローの脆弱性です。細工したIPv6ルーター通知パケットにより、NetworkManagerでバッファオーバーフローが起きるおそれがあり、CVSSv3の基本値は8.1です。1.0以上1.7-7未満の版が影響を受け、修正版は1.7-7です。修正版への更新を検討してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
2024年5月31日に公表された、libndpのバッファオーバーフローの脆弱性です。細工したIPv6ルーター通知パケットにより、NetworkManagerでバッファオーバーフローが起きるおそれがあり、CVSSv3の基本値は8.1です。1.0以上1.7-7未満の版が影響を受け、修正版は1.7-7です。修正版への更新を検討してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| GitHublibndp |
≥ 1.0, < 1.7-7→ 1.7-7 |
1.7-7 |
| Red HatRed Hat Enterprise Linux 10 | — | Not listed |
| Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support | — | Not listed |
| Red HatRed Hat Enterprise Linux 8 | — | Not listed |
| Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support | — | Not listed |
| Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | Not listed |
| Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service | — | Not listed |
| Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | Not listed |
| Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | Not listed |
| Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service | — | Not listed |
| Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | Not listed |
| Red HatRed Hat Enterprise Linux 8.8 Extended Update Support | — | Not listed |
| Red HatRed Hat Enterprise Linux 9 | — | Not listed |
| Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | Not listed |
| Red HatRed Hat Enterprise Linux 9.2 Extended Update Support | — | Not listed |
Fix status by distribution
Records published by each distribution for this CVE. Fixed versions differ by release; check each link.
- Debian DEBIAN-CVE-2024-5564 libndp Fix available
Original description The description as published by the source.
A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route length information.
Source: CVE.org (CVE Program・cvelistV5) NVD
References
- web secalert@redhat.com
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web bugzilla.redhat.com
- web lists.debian.org