CVE-2024-9050

Upstream information

CVE-2024-9050 at MITRE

Description

A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores

	CNA (Red Hat)
Base Score	7.8
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Local
Attack Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3.1

SUSE Bugzilla entries: 1231331 [RESOLVED / DUPLICATE], 1232040 [NEW]

SUSE Security Advisories:

• RHSA-2024:8353, published Fri Oct 25 15:05:51 UTC 2024
• RHSA-2024:8357, published Mon Nov 18 16:05:57 UTC 2024
• RHSA-2024:9555, published Thu Nov 21 16:06:26 UTC 2024
• openSUSE-SU-2024:14422-1, published Thu Oct 24 18:50:07 2024

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Liberty Linux 7 LTSS	NetworkManager-libreswan >= 1.2.4-4.el7_9 NetworkManager-libreswan-gnome >= 1.2.4-4.el7_9	Patchnames: RHSA-2024:8357
SUSE Liberty Linux 8	NetworkManager-libreswan >= 1.2.10-7.el8_10 NetworkManager-libreswan-gnome >= 1.2.10-7.el8_10	Patchnames: RHSA-2024:8353
SUSE Liberty Linux 9	NetworkManager-libreswan >= 1.2.22-4.el9_5 NetworkManager-libreswan-gnome >= 1.2.22-4.el9_5	Patchnames: RHSA-2024:9555
openSUSE Tumbleweed	NetworkManager-applet-libreswan >= 1.2.24-1.1 NetworkManager-libreswan >= 1.2.24-1.1 NetworkManager-libreswan-lang >= 1.2.24-1.1	Patchnames: openSUSE-Tumbleweed-2024-14422

---

SUSE Timeline for this CVE

CVE page created: Tue Oct 22 16:00:07 2024
CVE page last modified: Thu Nov 21 19:50:59 2024