{"id":120285,"date":"2024-10-25T13:09:16","date_gmt":"2024-10-25T11:09:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-networkmanager-libreswan-i-guix-daemon-pozvolyayushhie-povysit-privilegii-v-sisteme"},"modified":"2024-10-25T13:09:16","modified_gmt":"2024-10-25T11:09:16","slug":"uyazvimost-v-networkmanager-libreswan-i-guix-daemon-pozvolyayushhie-povysit-privilegii-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-networkmanager-libreswan-i-guix-daemon-pozvolyayushhie-povysit-privilegii-v-sisteme","title":{"rendered":"A vulnerability in NetworkManager-libreswan and guix-daemon that allows privilege escalation in the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A vulnerability (CVE-2024-9050) has been identified in the NetworkManager-libreswan plugin, which adds functionality to NetworkManager for connecting to VPNs compatible with servers based on Libreswan and Cisco IPsec. This vulnerability could be exploited by a local user to elevate their privileges. The issue has been addressed in the NetworkManager-libreswan update 1.2.24. You can track updates in distributions on the following pages: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora. <\/p>\n

The issue is caused by improper validation of the configuration. VPN<\/a>, defined by a local unprivileged user and passed directly to Libreswan when attempting to activate the connection. In particular, the plugin did not verify the use of escape characters, such as the newline «\n», which could be used to separate individual settings specified on a single line. <\/p>\n

Accordingly, an attacker could specify one of the allowed parameters as the parameter «leftupdown», which is prohibited for unprivileged users and defines a script executed with root privileges during the connection setup. For example, to run the program \/bin\/true, the following settings could be attached to the allowed parameter «hostaddrfamily»: hostaddrfamily=ipv4\n leftupdown=\/bin\/true\n ikev2=never\n leftxauthclient=yes\n leftusername=username\n phase2alg=aes256-sha1\n authby=secret\n left=faultroute\n leftmodecfgclient=yes\n right=172.31.79.2\nconn ign <\/p>\n

Another vulnerability has been found in the background process guix-daemon, used in distributions based on the GNU Guix package manager. This vulnerability poses a risk to multi-user systems and allows a local user to gain privileges of any user running the build process (build user) and make changes to the build results. The essence of the vulnerability is that an attacker can initiate a derived build, and if the build process is interrupted, the created suid files will remain accessible to other users of the system. After this, the attacker can exploit the created suid file to pause the build process, open any file via \/proc\/$PID\/fd with the privileges of the user executing the build, and overwrite files with the build results.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 NetworkManager-libreswan, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0432 NetworkManager \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a VPN, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u044b\u043c \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 Libreswan \u0438 Cisco IPsec, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-9050), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 NetworkManager-libreswan 1.2.24. \u041f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0437\u0430 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120285","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerability in NetworkManager-libreswan and guix-daemon allows privilege escalation in the system | ProHoster","description":"A vulnerability (CVE-2024-9050) has been identified in the NetworkManager-libreswan plugin, which adds functionality to NetworkManager for connecting to VPNs compatible with servers based on Libreswan and Cisco IPsec.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-networkmanager-libreswan-i-guix-daemon-pozvolyayushhie-povysit-privilegii-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NetworkManager-libreswan \u0438 guix-daemon, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 NetworkManager-libreswan, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0432 NetworkManager \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a VPN, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u044b\u043c \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 Libreswan \u0438 Cisco IPsec, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-9050), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-networkmanager-libreswan-i-guix-daemon-pozvolyayushhie-povysit-privilegii-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-10-25T11:09:16+00:00","article:modified_time":"2024-10-25T11:09:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120285","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:02:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 07:28:20","updated":"2026-02-04 15:02:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/120285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=120285"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/120285\/revisions"}],"predecessor-version":[{"id":156887,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/120285\/revisions\/156887"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=120285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=120285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=120285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}