A vulnerability (CVE-2024-9050) has been identified in the NetworkManager-libreswan plugin, which adds functionality to NetworkManager for connecting to VPNs compatible with servers based on Libreswan and Cisco IPsec. This vulnerability could be exploited by a local user to elevate their privileges. The issue has been addressed in the NetworkManager-libreswan update 1.2.24. You can track updates in distributions on the following pages: Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora.
The issue is caused by improper validation of the configuration. VPNdefined by a local unprivileged user and passed directly to Libreswan when attempting to activate the connection. Specifically, the plugin failed to check for the use of escape characters like newline "\n", which could be used to separate individual settings specified in a single line.
Consequently, an attacker could specify in one of the allowed parameters the “leftupdown” parameter, which is prohibited for unprivileged users and specifies a script that is executed with root privileges during the connection setup process. For example, to execute the program /bin/true, the following settings can be attached to the allowed parameter “hostaddrfamily”: hostaddrfamily=ipv4\n leftupdown=/bin/true\n ikev2=never\n leftxauthclient=yes\n leftusername=username\n phase2alg=aes256-sha1\n authby=secret\n left=faultroute\n leftmodecfgclient=yes\n right=172.31.79.2\nconn ign
Another vulnerability has been found in the background process guix-daemon, used in distributions based on the GNU Guix package manager. This vulnerability poses a risk to multi-user systems and allows a local user to gain privileges of any user running the build process (build user) and make changes to the build results. The essence of the vulnerability is that an attacker can initiate a derived build, and if the build process is interrupted, the created suid files will remain accessible to other users of the system. After this, the attacker can exploit the created suid file to pause the build process, open any file via /proc/$PID/fd with the privileges of the user executing the build, and overwrite files with the build results.
Source: opennet.ru
