Important: libndp security update
Summary
ALSA-2024:4620: Important: libndp security update. Affects libndp versions < 1.7-7.el8_10.alma.1. Fixed in 1.7-7.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libndp is a library used by NetworkManager that provides a wrapper for the IPv6 Neighbor Discovery Protocol. It also includes a tool called ndptool for sending and receiving NDP messages.
Vulnerability Detail
A buffer overflow vulnerability has been discovered in libndp, specifically in the route information length field. This vulnerability is identified as CVE-2024-5564. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service. The impact of this vulnerability is considered important.
How To Fix
Minimum fixed version
1.7-7.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update libndpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
A buffer overflow vulnerability has been identified in libndp, which could allow an attacker to execute arbitrary code or cause a denial of service. It is recommended to update the libndp package to version 1.7-7.el8_10.alma.1 or later to mitigate this vulnerability.
See every vulnerability recorded for libndp →
FAQ
Libndp is a library used by NetworkManager to handle the IPv6 Neighbor Discovery Protocol.
The vulnerability could allow an attacker to execute arbitrary code or cause a denial of service.
Update the libndp package to version 1.7-7.el8_10.alma.1 or later.
No specific workaround has been provided for this vulnerability.
You can refer to the CVE page(s) listed in the References section of the advisory for more details.
Related vulnerabilities
Recent vulnerabilities recorded for libndp.
