CVE-2024-6501: Networkmanager: denial of service
A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a malicious user could inject a malformed LLDP packet. NetworkManager would crash, leading to a denial of service.
Other sources
Given a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, someone could inject a malformed LLDP packet and NetworkManager would crash leading to a DoS.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/network-managerto a version that resolves this vulnerability.Fixed in 1.42.4-1+deb12u1 - Upgrade
Upgrade
debian/network-managerto a version that resolves this vulnerability.Fixed in 1.49.90-2 - Upgrade
Upgrade
debian/network-managerto a version that resolves this vulnerability.Fixed in 1.42.4-1+deb12u1Fixed in 1.52.1-1Fixed in 1.58.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6501?
CVE-2024-6501 has been classified as a denial of service vulnerability.
How do I fix CVE-2024-6501?
To fix CVE-2024-6501, users should update NetworkManager to the latest version that addresses this vulnerability.
Who is affected by CVE-2024-6501?
CVE-2024-6501 affects systems running NetworkManager with LLDP enabled and DEBUG logging turned on.
What is the impact of CVE-2024-6501?
The impact of CVE-2024-6501 is that it may cause NetworkManager to crash, leading to a denial of service.
How can a malicious user exploit CVE-2024-6501?
A malicious user can exploit CVE-2024-6501 by injecting a malformed LLDP packet into an affected system.