Bug 926223 (CVE-2015-2924) - VUL-2: CVE-2015-2924: NetworkManager: IPv6 Hop limit lowering via RA messages
Summary: VUL-2: CVE-2015-2924: NetworkManager: IPv6 Hop limit lowering via RA messages
Status: RESOLVED FIXED
Alias: CVE-2015-2924
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/115570/
Whiteboard: CVSSv2:NVD:CVE-2015-2924:3.3:(AV:A/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-07 13:21 UTC by Andreas Stieger
Modified: 2020-10-21 09:18 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-04-07 13:21:05 UTC
Via oss-sec http://seclists.org/oss-sec/2015/q2/46

    An unprivileged user on a local network can use IPv6 Neighbour
    Discovery ICMP to broadcast a non-route with a low hop limit, this
    causing machines to lower the hop limit on existing IPv6 routes.

    Projects impacted:  Linux kernel,  NetworkManager, FreeBSD Kernel
[...]
    ,  NetworkManager


This might refer to
http://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/src/rdisc/nm-lndp-rdisc.c

  hop_limit = ndp_msgra_curhoplimit (msgra);
  if (rdisc->hop_limit != hop_limit) {
          rdisc->hop_limit = hop_limit;
          changed |= NM_RDISC_CONFIG_HOP_LIMIT;

however, the MITRE CVE team is not directly familiar with this part of
the NetworkManager code and has not researched any changes to the
"rdisc->hop_limit != hop_limit" test. There is apparently no commit
available yet at:

  http://cgit.freedesktop.org/NetworkManager/NetworkManager/log/src/rdisc/nm-lndp-rdisc.c

but, again, we don't know whether changes would need to occur there.

Use CVE-2015-2924 for the NetworkManager vulnerability.



References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2924
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-2924.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2924
Comment 2 Swamp Workflow Management 2015-04-07 22:00:33 UTC
bugbot adjusting priority
Comment 5 Andreas Stieger 2016-12-22 10:37:26 UTC
Assign to new bugowner
Comment 8 Jonathan Kang 2019-04-25 08:59:47 UTC
The fix has been in SUSE:SLE-12-SP2:Update and SUSE:SLE-15:Update. For
SUSE:SLE-11-SP1:Update and SUSE:SLE-11-SP2:Update, this CVE doesn't apply to
those two projects.
Comment 9 Alexandros Toptsoglou 2020-07-10 13:10:27 UTC
Done