Description
A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | NetworkManager-libreswan | < 1.2.24 | 1.2.24 |
| Red Hat | Red Hat Enterprise Linux 7.7 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | NetworkManager-libreswan +1 | 1.2.22-4.el9_5 | RHSA-2024:9555 |
| RHEL 8 | NetworkManager-libreswan +1 | 1.2.10-7.el8_10 | RHSA-2024:8353 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | NetworkManager-libreswan +1 | 1.2.18-6.el9_4 | RHSA-2024:9556 |
| RHEL 9.2 EUS | NetworkManager-libreswan +1 | 1.2.14-6.el9_2 | RHSA-2024:8352 |
| RHEL 9.0 E4S | NetworkManager-libreswan +1 | 1.2.14-3.el9_0 | RHSA-2024:8312 |
| RHEL 8.8 EUS | NetworkManager-libreswan +1 | 1.2.10-6.el8_8 | RHSA-2024:8354 |
| RHEL 8.6 TUS | NetworkManager-libreswan +1 | 1.2.10-6.el8_6 | RHSA-2024:8356 |
| RHEL 8.6 E4S | NetworkManager-libreswan +1 | 1.2.10-6.el8_6 | RHSA-2024:8356 |
| RHEL 8.6 AUS | NetworkManager-libreswan +1 | 1.2.10-6.el8_6 | RHSA-2024:8356 |
| RHEL 8.4 TUS | NetworkManager-libreswan +1 | 1.2.10-6.el8_4 | RHSA-2024:8355 |
| RHEL 8.4 E4S | NetworkManager-libreswan +1 | 1.2.10-6.el8_4 | RHSA-2024:8355 |
| RHEL 8.4 AUS | NetworkManager-libreswan +1 | 1.2.10-6.el8_4 | RHSA-2024:8355 |
| RHEL 8.2 AUS | NetworkManager-libreswan +1 | 1.2.10-6.el8_2 | RHSA-2024:8358 |
| RHEL 7.7 AUS | NetworkManager-libreswan +1 | 1.2.4-4.el7_7 | RHSA-2024:8338 |
| RHEL 7 ELS | NetworkManager-libreswan +1 | 1.2.4-4.el7_9 | RHSA-2024:8357 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | NetworkManager-libreswan +1 | 1.2.22-4.el9_5 | ALSA-2024:9555 |
| AlmaLinux 8 | NetworkManager-libreswan +1 | 1.2.10-7.el8_10 | ALSA-2024:8353 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | NetworkManager-libreswan | 1.2.22-4.el9_5 | RLSA-2024:9555 |
| Rocky Linux 8 | NetworkManager-libreswan | 1.2.10-7.el8_10 | RLSA-2024:8353 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | NetworkManager-libreswan | 1.2.24-1.1 | openSUSE-SU-2024:14422-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | NetworkManager-libreswan +1 | 1.2.4-4.amzn2 | ALAS2-2024-2703 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | NetworkManager-libreswan +1 | 1.2.22-4.el9_5 | ELSA-2024-9555 |
| Oracle Linux 8 | NetworkManager-libreswan +1 | 1.2.10-7.el8_10 | ELSA-2024-8353 |
| Oracle Linux 7 | NetworkManager-libreswan +1 | 1.2.4-2.0.1.el7 | ELSA-2024-8357 |
Advisories 21
- ALSA-2024:9555 Important: NetworkManager-libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:8353 Important: NetworkManager-libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:9555 Red Hat Security Advisory: NetworkManager-libreswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:8354 Red Hat Security Advisory: NetworkManager-libreswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:8355 Red Hat Security Advisory: NetworkManager-libreswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:8356 Red Hat Security Advisory: NetworkManager-libreswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:8357 Red Hat Security Advisory: NetworkManager-libreswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:8312 Red Hat Security Advisory: NetworkManager-libreswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:8353 Red Hat Security Advisory: NetworkManager-libreswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:9556 Red Hat Security Advisory: NetworkManager-libreswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:8358 Red Hat Security Advisory: NetworkManager-libreswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:8338 Red Hat Security Advisory: NetworkManager-libreswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2024:8352 Red Hat Security Advisory: NetworkManager-libreswan:1.2.14 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- WID-SEC-2024-3254 Red Hat Enterprise Linux (NetworkManager-libreswan): Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jun 10, 2026
- RLSA-2024:9555 Important: NetworkManager-libreswan security update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:14422-1 NetworkManager-applet-libreswan-1.2.24-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2024:8353 Important: NetworkManager-libreswan security update Rocky Linux Security Advisories · May 7, 2025
- ALAS2-2024-2703 Moderate: NetworkManager-libreswan security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 19, 2024
- ELSA-2024-9555 Important: NetworkManager-libreswan security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 18, 2024
- ELSA-2024-8357 Important: NetworkManager-libreswan security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 8, 2024
- ELSA-2024-8353 Important: NetworkManager-libreswan security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 23, 2024
References
- RHSA-2024:8312 vendor-advisory
- RHSA-2024:8338 vendor-advisory
- RHSA-2024:8352 vendor-advisory
- RHSA-2024:8353 vendor-advisory
- RHSA-2024:8354 vendor-advisory
- RHSA-2024:8355 vendor-advisory
- RHSA-2024:8356 vendor-advisory
- RHSA-2024:8357 vendor-advisory
- RHSA-2024:8358 vendor-advisory
- RHSA-2024:9555 vendor-advisory
- RHSA-2024:9556 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-9050 vdb-entry
- RHBZ#2313828 issue-tracking
- https://gitlab.gnome.org/GNOME/NetworkManager-libreswan/-/commit/dcf8acfb25bd31e4b8cbd20c229da660238b5c1b
- https://www.openwall.com/lists/oss-security/2024/10/25/1