Описание
A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.
Отчет
This Moderate local privilege escalation flaw in NetworkManager's dhclient backend is not exploitable in default Red Hat Enterprise Linux configurations. Exploitation requires an administrator to explicitly configure NetworkManager to use dhclient instead of its default internal DHCP client, allowing a local user to escalate privileges via a crafted MUD URL.
Меры по смягчению последствий
To prevent exploitation, ensure NetworkManager is not configured to use the dhclient backend. The default configuration on Red Hat Enterprise Linux does not enable dhclient. If a custom configuration file, such as /etc/NetworkManager/conf.d/00-dhcp.conf, contains [main] dhcp=dhclient, remove or comment out this line. After modifying the configuration, restart the NetworkManager service: sudo systemctl restart NetworkManager Warning: Restarting the NetworkManager service will temporarily disrupt network connectivity.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Multicluster Engine for Kubernetes | multicluster-engine/cluster-api-provider-aws-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | NetworkManager | Not affected | ||
| Red Hat Enterprise Linux 6 | NetworkManager | Not affected | ||
| Red Hat Enterprise Linux 7 | NetworkManager | Not affected | ||
| Red Hat Hardened Images | NetworkManager | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | networkmanager | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | NetworkManager | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift4/kubernetes-nmstate-rhel8-operator | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift4/kubernetes-nmstate-rhel9-operator | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-aws-cluster-api-controllers-rhel8 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.7 Medium
CVSS3
Связанные уязвимости
A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.
A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.
A flaw was found in NetworkManager. This local privilege escalation vu ...
EPSS
6.7 Medium
CVSS3