CVE-2024-5564 json
Libndp: buffer overflow in route information length field
published 2024-05-31 2 y ago modified 2026-11-04 4 d ago also EUVD-2024-47152
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route length information.
Patch / fix
- Red Hat Red Hat Enterprise Linux 10 0:1.9-2.el10
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.2-10.el7_9
- Red Hat Red Hat Enterprise Linux 8 0:1.7-7.el8_10
- Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:1.7-4.el8_2
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.7-6.el8_4
- Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 0:1.7-6.el8_4
- Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 0:1.7-6.el8_4
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:1.7-7.el8_6
- Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:1.7-7.el8_6
- Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:1.7-7.el8_6
- Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 0:1.7-7.el8_8
- Red Hat Red Hat Enterprise Linux 9 0:1.8-6.el9_4
- Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:1.8-5.el9_0
- Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 0:1.8-5.el9_2
- libndp Debian 12 1.8-1+deb12u1
- libndp Debian 14, Debian 13 1.8-2
debian advisories DEBIAN-CVE-2024-5564
- libndp Ubuntu 20.04 LTS 1.7-0ubuntu1.1
- libndp Ubuntu 22.04 LTS 1.8-0ubuntu3.1
- libndp Ubuntu 24.04 LTS 1.8-1fakesync1ubuntu0.24.04.1
- libndp Ubuntu Pro 16.04 LTS 1.4-2ubuntu0.16.04.1+esm1
- libndp Ubuntu Pro 18.04 LTS 1.6-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2024-5564
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- libndp RHEL 10.0 1.9-2.el10
- libndp RHEL 9 1.8-6.el9_4
- libndp RHEL 8 1.7-7.el8_10
- libndp RHEL 9.2 EUS 1.8-5.el9_2
- libndp RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 1.7-7.el8_6
- libndp RHEL 8.8 EUS 1.7-7.el8_8
- libndp RHEL 8.2 AUS 1.7-4.el8_2
- libndp RHEL 7 ELS 1.2-10.el7_9
red hat advisories RHBA-2025:6631RHSA-2024:4642RHSA-2024:4643RHSA-2024:4641RHSA-2024:4640RHSA-2024:4636
- libndp Linux Micro 6.0 1.8-3.1
- libndp SLES for SAP 12 SP5, SLES 12 SP5 1.6-4.5.1
- libndp SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +15 more 1.6-150000.3.3.1
suse advisories SUSE-SU-2025:20088-1SUSE-SU-2024:2541-1SUSE-SU-2024:2283-1
- libndp openSUSE Tumbleweed 1.8-2.1
opensuse advisories openSUSE-SU-2024:14112-1
- libndp AlmaLinux 8 1.7-7.el8_10.alma.1
- libndp AlmaLinux 9 1.8-6.el9_4.alma.1
almalinux advisories ALSA-2024:4620ALSA-2024:4636
- libndp Rocky Linux 9 1.8-6.el9_4
- libndp Rocky Linux 8 1.7-7.el8_10
rocky linux advisories RLSA-2024:4636RLSA-2024:4620
- libndp CBL-Mariner 2.0, Azure Linux 3.0 1.8-2
azure linux advisories AZL-42609AZL-42625
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-5564 updated cvss 8.1
libndp: buffer overflow in route information length field
-
Red Hat Enterprise Linux BaseOS (v. 8) libndp 1.7-7.el8_10fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4620
-
Red Hat Enterprise Linux BaseOS (v. 9) libndp 1.8-6.el9_4fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4636
-
Red Hat Enterprise Linux BaseOS (v. 10) libndp 1.9-2.el10fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHBA-2025:6631
-
Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libndp 1.7-4.el8_2fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4640
-
Red Hat Enterprise Linux BaseOS AUS (v.8.4) libndp 1.7-6.el8_4fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4618
-
Red Hat Enterprise Linux BaseOS AUS (v.8.6) libndp 1.7-7.el8_6fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4643
-
Red Hat Enterprise Linux BaseOS E4S (v.8.4) libndp 1.7-6.el8_4fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4618
-
Red Hat Enterprise Linux BaseOS E4S (v.8.6) libndp 1.7-7.el8_6fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4643
show 6 moreshow fewer
-
Red Hat Enterprise Linux BaseOS E4S (v.9.0) libndp 1.8-5.el9_0fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4619
-
Red Hat Enterprise Linux BaseOS EUS (v.8.8) libndp 1.7-7.el8_8fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4641
-
Red Hat Enterprise Linux BaseOS EUS (v.9.2) libndp 1.8-5.el9_2fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4642
-
Red Hat Enterprise Linux BaseOS TUS (v.8.4) libndp 1.7-6.el8_4fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4618
-
Red Hat Enterprise Linux BaseOS TUS (v.8.6) libndp 1.7-7.el8_6fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4643
-
Red Hat Enterprise Linux Server (v. 7 ELS) libndp 1.2-10.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) libndp-devel 1.2-10.el7_9, libndp-debuginfo 1.2-10.el7_9fixed: vendor fix “Currently there is no mitigation available for this vulnerability. Please make sure to update as the fixes become available.” RHSA-2024:4622
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.17% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
Classification
- Weakness
-
- CWE-120 Buffer Copy without Checking Size of Input
References
-
access.redhat.com
/errata/RHBA-2025:6631
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4618
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4619
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4620
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4622
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4636
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4640
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4641
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4642
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:4643
vendor-advisory
-
access.redhat.com
/security/cve/CVE-2024-5564
vdb-entry
-
bugzilla.redhat.com
/show_bug.cgi?id=2284122
issue-tracking
- lists.debian.org /debian-lts-announce/2024/06/msg00011.html
Sources
- CVE List CVE-2024-5564
- NVD CVE-2024-5564
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.