CVE-2024-6501 is a denial of service vulnerability in NetworkManager affecting versions >=9.0 <9.5. When DEBUG logging is enabled and an interface (e.g., eth1) has LLDP enabled, a malicious user can inject a malformed LLDP packet that causes NetworkManager to crash. This flaw relates to uncontrolled resource consumption (CWE-400). The vulnerability requires network access, has high attack complexity, no privileges required, and requires user interaction. The scope is unchanged, and the impact is limited to availability (denial of service).

The vulnerability can cause NetworkManager to crash, resulting in a denial of service on affected systems. There is no impact on confidentiality or integrity. The severity is low because the conditions for exploitation (DEBUG logging enabled with LLDP on an interface) are uncommon in production environments. No known exploits are reported in the wild.

A security update fixing this vulnerability is available from Red Hat as part of Red Hat Enterprise Linux 9.5 updates. Users should apply the NetworkManager update provided by Red Hat to remediate this issue. Since the vulnerability requires DEBUG logging enabled with LLDP, disabling DEBUG logs or LLDP on interfaces can mitigate the risk. Refer to Red Hat advisory RHSA-2024:9317 for detailed update instructions.