CVE-2015-0272

What it actually does

Remote attacker sends crafted IPv6 Router Advertisement packet containing malicious MTU value that triggers denial of service by disrupting IPv6 traffic processing in NetworkManager.

Why it matters to the business

Systems relying on this network configuration tool may experience sudden loss of IPv6 connectivity, leading to operational downtime and service interruptions on affected Linux environments.

How an attack unfolds

An attacker on the local network crafts and transmits an IPv6 Router Advertisement message with an invalid MTU value; the vulnerable NetworkManager processes the packet without validation, resulting in IPv6 traffic disruption.

How to fix it

Apply the latest vendor-supplied updates for NetworkManager on all affected distributions including SUSE Linux Enterprise, Ubuntu, and Oracle Linux; monitor upstream GNOME releases for security patches addressing IPv6 RA handling.

How to confirm the fix worked

Verify installed NetworkManager version against vendor advisories; test IPv6 RA processing in a lab environment with controlled packets to confirm absence of disruption; review system logs for IPv6 interface errors post-update.

Typical attack path

1. Position on local network segment to send IPv6 packets
2. Craft IPv6 Router Advertisement message with malicious MTU value
3. Transmit the packet to target systems running NetworkManager
4. Observe resulting IPv6 traffic disruption on affected hosts

How to detect it

Review network packet captures and system logs for repeated or anomalous IPv6 Router Advertisement messages; correlate with NetworkManager process restarts or interface state changes indicating IPv6 disruption.

What your security team should do

• Prioritize patching NetworkManager across all Linux deployments due to remote exploitability
• Implement network segmentation to limit exposure to untrusted IPv6 Router Advertisements
• Enable IPv6 RA guard features on switches where supported to filter malicious messages