Networkmanager-libreswan: local privilege escalation via leftupdown
CVE-2024-9050
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 22 October 2024
What is CVE-2024-9050?
A security flaw exists in the libreswan client plugin for NetworkManager, specifically within its handling of VPN configurations. This vulnerability arises from improper sanitation of the configuration input provided by local unprivileged users. This key-value format configuration management fails to adequately escape special characters, causing the application to misinterpret values as keys. This misconfiguration could allow malicious actors to manipulate key parameters such as 'leftupdown', which is capable of running executable commands. Because NetworkManager employs Polkit to permit unprivileged users to alter system network settings, an attacker could escalate privileges locally, potentially leading to root-level code execution on the affected system by crafting a malicious configuration.
Affected Version(s)
Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.2.4-4.el7_9
Red Hat Enterprise Linux 7.7 Advanced Update Support 0:1.2.4-4.el7_7
Red Hat Enterprise Linux 8 0:1.2.10-7.el8_10