Skip to content
OpenAdvisories
High · 7.6 Public exploit CVE-2024-3661 EUVD-2024-32236GHSA-jcv7-6v4q-4m7x

DHCP routing options can manipulate interface-based VPN traffic

Published May 6, 2024 · Updated Aug 28, 2024 · Assigned by cisa-cg

Vendor: IETF Product: DHCP Package: connman Package: gadmin-openvpn-client Package: gadmin-openvpn-server Package: golang-github-apparentlymart-go-openvpn-mgmt Package: kvpnc Package: libreswan Package: mozillavpn Package: n2n Package: network-manager-fortisslvpn Package: network-manager-iodine Package: network-manager-l2tp Package: network-manager-openconnect Package: network-manager-openvpn Package: network-manager-pptp Package: network-manager-sstp Package: network-manager-strongswan Package: network-manager-vpnc Package: openconnect Package: openfortivpn Package: openvpn Package: pptp-linux Package: pptpd Package: quicktun Package: riseup-vpn Package: softether-vpn Package: sshuttle Package: tinc Package: vpnc Package: wireguard Ecosystem: Ubuntu

Description

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

Affected products

VendorProductAffectedFixed
IETF DHCP — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS n2n +23 No fix yet —
Ubuntu 22.04 LTS n2n +24 No fix yet —
Ubuntu 20.04 LTS n2n +22 No fix yet —
Ubuntu 18.04 LTS n2n +20 No fix yet —
Ubuntu 16.04 LTS n2n +15 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS pptpd No fix yet —
Ubuntu Pro 20.04 LTS openconnect No fix yet —
Ubuntu Pro 18.04 LTS connman +2 No fix yet —
Ubuntu Pro 16.04 LTS connman +2 No fix yet —
Ubuntu Pro 14.04 LTS openvpn No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 NetworkManager +15 1:1.48.10-5.el9_5 RHSA-2025:0377
RHEL 8 NetworkManager +15 1:1.40.16-18.el8_10 RHSA-2025:0288
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS NetworkManager +15 1:1.46.0-34.el9_4 RHSA-2025:16411

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 NetworkManager +15 1:1.48.10-5.el9_5 ALSA-2025:0377
AlmaLinux 8 NetworkManager +15 1:1.40.16-18.el8_10 ALSA-2025:0288

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 NetworkManager 1:1.48.10-5.el9_5 RLSA-2025:0377
Rocky Linux 8 NetworkManager 1:1.40.16-18.el8_10 RLSA-2025:0288

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 NetworkManager +15 1:1.48.10-5.0.1.el9_5 ELSA-2025-0377
Oracle Linux 8 NetworkManager +15 1:1.40.16-18.0.1.el8_10 ELSA-2025-0288

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 10

References