CVE-2024-5564

Full vulnerability record from the local CVENow database.
Description

A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route length information.
Severity
HIGH
CVSS score
8.1 (v3.1)
Vulnerability status
Deferred
Source identifier
[email protected]
Published
2024-05-31 19:15:08.883000
Last modified
2026-11-04 22:17:23.190000
View original CVE JSON
{
  "id": "CVE-2024-5564",
  "sourceIdentifier": "[email protected]",
  "published": "2024-05-31T19:15:08.883",
  "lastModified": "2026-11-04T22:17:23.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route length information."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en libndp. Esta falla permite que un usuario malintencionado local provoque un desbordamiento del búfer en NetworkManager, provocado al enviar un paquete de publicidad de enrutador IPv6 con formato incorrecto. Este problema se produjo porque libndp no validaba correctamente la información de longitud de la ruta."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/jpirko/libndp",
          "packageName": "libndp",
          "versions": [
            {
              "version": "1.0",
              "lessThan": "1.7-7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.0"
          ],
          "versions": [
            {
              "version": "0:1.9-2.el10",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "versions": [
            {
              "version": "0:1.2-10.el7_9",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "versions": [
            {
              "version": "0:1.7-7.el8_10",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.2::baseos"
          ],
          "versions": [
            {
              "version": "0:1.7-4.el8_2",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "versions": [
            {
              "version": "0:1.7-6.el8_4",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "versions": [
            {
              "version": "0:1.7-6.el8_4",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_e4s:8.4::baseos",
            "cpe:/o:redhat:rhel_tus:8.4::baseos"
          ],
          "versions": [
            {
              "version": "0:1.7-6.el8_4",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "versions": [
            {
              "version": "0:1.7-7.el8_6",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "versions": [
            {
              "version": "0:1.7-7.el8_6",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "versions": [
            {
              "version": "0:1.7-7.el8_6",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_eus:8.8::baseos"
          ],
          "versions": [
            {
              "version": "0:1.7-7.el8_8",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "versions": [
            {
              "version": "0:1.8-6.el9_4",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_e4s:9.0::baseos"
          ],
          "versions": [
            {
              "version": "0:1.8-5.el9_0",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "libndp",
          "cpes": [
            "cpe:/o:redhat:rhel_eus:9.2::baseos"
          ],
          "versions": [
            {
              "version": "0:1.8-5.el9_2",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2024-05-31T20:17:36.331326Z",
          "id": "CVE-2024-5564",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHBA-2025:6631",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4618",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4619",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4620",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4622",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4636",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4640",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4641",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4642",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4643",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2024-5564",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284122",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4618",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4619",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4620",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4622",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4636",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4640",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4641",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4642",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2024:4643",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2024-5564",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284122",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00011.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}