This vulnerability exists in NetworkManager's dhclient backend due to improper neutralization of special elements used in OS commands (OS command injection) when processing malformed MUD URLs. A local user with low privileges can escalate their privileges by exploiting this flaw, provided the system administrator has configured NetworkManager to use the dhclient backend. The default configuration uses an internal DHCP client and is not affected. Exploitation requires user interaction and has high attack complexity. The vulnerability impacts confidentiality, integrity, and availability by allowing unauthorized command execution, potentially leading to system compromise or denial of service.

If exploited, an attacker with local access can execute unauthorized operating system commands with elevated privileges, potentially leading to full system compromise, data modification, or denial of service. However, exploitation requires a non-default configuration where NetworkManager is set to use dhclient, which is not enabled by default on Red Hat Enterprise Linux systems. Therefore, the risk is limited to systems with this explicit configuration change.

Red Hat advises ensuring that NetworkManager is not configured to use the dhclient backend. The default configuration does not enable dhclient. If a custom configuration file such as /etc/NetworkManager/conf.d/00-dhcp.conf contains the line '[main] dhcp=dhclient', this line should be removed or commented out. After making this change, restart the NetworkManager service using 'sudo systemctl restart NetworkManager'. Note that restarting NetworkManager will temporarily disrupt network connectivity. No official patch or fix is currently available; mitigation relies on configuration changes.