Description
A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a malicious user could inject a malformed LLDP packet. NetworkManager would crash, leading to a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | NetworkManager | 1.40 – < 1.48.10-2 | 1.48.10-2 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | network-manager | 1.49.90-2 | — |
| Debian 13 | network-manager | 1.49.90-2 | — |
| Debian 12 | network-manager | 1.42.4-1+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | network-manager | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | NetworkManager +15 | 1:1.48.10-2.el9_5 | RHSA-2024:9317 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | NetworkManager +15 | 1:1.48.10-2.el9_5.alma.1 | ALSA-2024:9317 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | NetworkManager +15 | 1:1.48.10-2.0.1.el9_5 | ELSA-2024-9317 |
Advisories 4
- ALSA-2024:9317 Low: NetworkManager security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:9317 Red Hat Security Advisory: NetworkManager security update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- WID-SEC-2024-3409 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 1, 2026
- ELSA-2024-9317 Low: NetworkManager security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 14, 2024
References
- RHSA-2024:9317 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-6501 vdb-entry
- RHBZ#2295734 issue-tracking