CVE-2024-5564

What it actually does

Improper validation of route length in IPv6 router advertisement packets within libndp allows a buffer overflow in NetworkManager, enabling memory corruption that can lead to crashes or arbitrary code execution.

Why it matters to the business

Attackers could disrupt network connectivity services or gain elevated access on affected systems, resulting in downtime, data exposure, or further compromise of hosts relying on NetworkManager for IPv6 handling.

How an attack unfolds

An attacker with local access crafts and sends a malformed IPv6 router advertisement packet containing invalid route length data; libndp fails to validate this input, triggering a buffer overflow in NetworkManager that an adversary can leverage for code execution or denial of service.

How to fix it

Upgrade libndp and NetworkManager to versions containing input validation fixes for IPv6 route advertisements; apply vendor patches as they become available and rebuild any dependent packages.

How to confirm the fix worked

Verify installed libndp and NetworkManager versions against upstream security advisories; test packet handling with controlled malformed IPv6 RAs in a lab environment and confirm absence of crashes or overflows via fuzzing or static analysis.

Typical attack path

1. Obtain local access or network-adjacent position to inject IPv6 traffic
2. Craft malformed IPv6 router advertisement with oversized or invalid route length field
3. Deliver packet to trigger libndp processing in NetworkManager
4. Exploit resulting buffer overflow for memory corruption or code execution

How to detect it

Review NetworkManager and system logs for segmentation faults or crashes during IPv6 packet processing; inspect network captures for anomalous router advertisement packets with suspicious route options; correlate with local user activity around the time of any service restarts.

What your security team should do

• Monitor for upstream fixes and schedule patching of libndp/NetworkManager across all systems
• Restrict local user privileges and IPv6 RA acceptance where feasible until mitigated
• Enable exploit mitigation features such as ASLR and stack canaries on affected hosts