CVE-2024-5564

Public on 2024-05-31
Modified on 2024-05-31
Description
A vulnerability was found in libndp. A buffer overflow in NetworkManager that can be triggered by sending a malformed IPv6 router advertisement packet via malicious user locally. This happens as libndp was not validating correctly the route length information and hence leading to a flaw. This affects versions of libndp >= 1.0.
Severity
Important severity
Important
CVSS v3 Base Score
7.4
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core libndp 2024-06-19 ALAS2-2024-2571 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv3 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H