The libndp library, which provides a wrapper for the IPv6 Neighbor Discovery Protocol and includes the ndptool utility, contains a buffer overflow vulnerability in the route information length field (CVE-2024-5564). This vulnerability could potentially allow an attacker to cause memory corruption by sending specially crafted NDP messages. Red Hat has released a security update for libndp in Red Hat Enterprise Linux 7 Extended Lifecycle Support to fix this issue. The advisory classifies the security impact as important. No CVSS score is provided in the advisory, and no exploits are currently known in the wild.

The vulnerability could allow an attacker to trigger a buffer overflow via the route information length field in libndp, potentially leading to memory corruption. This could affect systems running Red Hat Enterprise Linux 7 Extended Lifecycle Support using libndp, impacting the NetworkManager's handling of IPv6 Neighbor Discovery Protocol messages. No known exploitation in the wild has been reported.

Red Hat has released an official security update for libndp in Red Hat Enterprise Linux 7 Extended Lifecycle Support to address this vulnerability. Users should apply the updated libndp packages as provided by Red Hat to remediate this issue. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. Patch status is confirmed as fixed in the updated packages.