Skip to content
Fencer Vulns
low 3.1

CVE-2024-6501 json

Networkmanager: denial of service

published 2024-07-09 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-48009

cvss
3.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a malicious user could inject a malformed LLDP packet. NetworkManager would crash, leading to a denial of service.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 9 1:1.48.10-2.el9_5
  • network-manager Debian 12 1.42.4-1+deb12u1
  • network-manager Debian 14, Debian 13 1.49.90-2

debian advisories DEBIAN-CVE-2024-6501

  • NetworkManager RHEL 9 1:1.48.10-2.el9_5
  • NetworkManager-ovs RHEL 9 1:1.48.10-2.el9_5
  • NetworkManager-ppp RHEL 9 1:1.48.10-2.el9_5
  • NetworkManager-tui RHEL 9 1:1.48.10-2.el9_5
  • NetworkManager-adsl RHEL 9 1:1.48.10-2.el9_5
  • NetworkManager-team RHEL 9 1:1.48.10-2.el9_5
  • NetworkManager-wifi RHEL 9 1:1.48.10-2.el9_5
  • NetworkManager-wwan RHEL 9 1:1.48.10-2.el9_5

red hat advisories RHSA-2024:9317

  • NetworkManager AlmaLinux 9 1:1.48.10-2.el9_5.alma.1
  • NetworkManager-ovs AlmaLinux 9 1:1.48.10-2.el9_5.alma.1
  • NetworkManager-ppp AlmaLinux 9 1:1.48.10-2.el9_5.alma.1
  • NetworkManager-tui AlmaLinux 9 1:1.48.10-2.el9_5.alma.1
  • NetworkManager-adsl AlmaLinux 9 1:1.48.10-2.el9_5.alma.1
  • NetworkManager-team AlmaLinux 9 1:1.48.10-2.el9_5.alma.1
  • NetworkManager-wifi AlmaLinux 9 1:1.48.10-2.el9_5.alma.1
  • NetworkManager-wwan AlmaLinux 9 1:1.48.10-2.el9_5.alma.1

almalinux advisories ALSA-2024:9317

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-6501 updated cvss 3.1

NetworkManager: Denial of Service

  • Red Hat Enterprise Linux 8 NetworkManager, NetworkManager-ovs, NetworkManager-ppp, NetworkManager-tui, NetworkManager-adsl, NetworkManager-team, +9 more
    affected: no fix available
  • Red Hat OpenShift Container Platform 4 NetworkManager, NetworkManager-ovs, NetworkManager-ppp, NetworkManager-tui, NetworkManager-adsl, NetworkManager-team, +9 more
    affected: no fix available “Fix deferred”
  • Red Hat CodeReady Linux Builder (v. 9) NetworkManager-debuginfo 1.48.10-2.el9_5, NetworkManager-debugsource 1.48.10-2.el9_5, NetworkManager-libnm-devel 1.48.10-2.el9_5, NetworkManager-ovs-debuginfo 1.48.10-2.el9_5, NetworkManager-ppp-debuginfo 1.48.10-2.el9_5, NetworkManager-tui-debuginfo 1.48.10-2.el9_5, +7 more Red Hat Enterprise Linux AppStream (v. 9) NetworkManager-ovs 1.48.10-2.el9_5, NetworkManager-ppp 1.48.10-2.el9_5, NetworkManager-cloud-setup 1.48.10-2.el9_5, NetworkManager-dispatcher-routing-rules 1.48.10-2.el9_5, NetworkManager-config-connectivity-redhat 1.48.10-2.el9_5 Red Hat Enterprise Linux BaseOS (v. 9) NetworkManager 1.48.10-2.el9_5, NetworkManager-tui 1.48.10-2.el9_5, NetworkManager-adsl 1.48.10-2.el9_5, NetworkManager-team 1.48.10-2.el9_5, NetworkManager-wifi 1.48.10-2.el9_5, NetworkManager-wwan 1.48.10-2.el9_5, +4 more
    fixed: vendor fix RHSA-2024:9317
  • Red Hat Enterprise Linux 6 NetworkManager, NetworkManager-glib, NetworkManager-gnome Red Hat Enterprise Linux 7 NetworkManager, NetworkManager-ovs, NetworkManager-ppp, NetworkManager-tui, NetworkManager-adsl, NetworkManager-glib, +8 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.