CVE-2024-3661

CVE Details

Release Date:	2024-05-06
Impact:	Moderate	What is this?

Description

DHCP can add routes to a client's routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

See more information about CVE-2024-3661 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.6
Vector String:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Version:	3.1
Attack Vector:	Adjacent_Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	Low
Availability Impact:	Low

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (NetworkManager)	ELSA-2025-0288	2025-01-13
Oracle Linux version 9 (NetworkManager)	ELSA-2025-0377	2025-01-16