Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5564: A vulnerability was found in libndp. A buffer overflow in NetworkManager that can be triggered by sending a malformed IPv6 router advertisement packet via malicious user locally. This happens as libndp was not validating correctly the route length information and hence leading to a flaw. This affects versions of libndp >= 1.0.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libndp | 0:1.2-7.amzn2.0.3 |
| Amazon Linux · 2 | libndp-debuginfo | 0:1.2-7.amzn2.0.3 |
| Amazon Linux · 2 | libndp-devel | 0:1.2-7.amzn2.0.3 |
Vulnerabilities 1
-
High 8.1
Libndp: buffer overflow in route information length field
A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-5564.html