NetworkManager-libreswan plugin, which adds functionality to NetworkManager for connecting to VPNs compatible with servers based on Libreswan and Cisco IPsec, has a vulnerability (CVE-2024-9050) that can be exploited by a local user to elevate privileges. The vulnerability has been fixed in NetworkManager-libreswan update 1.2.24. You can track updates in distributions on the following pages: Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora.
The issue is caused by improper configuration checks VPN, defined by a local unprivileged user and passed directly to Libreswan when attempting to activate a connection. In particular, the plugin did not check the use of escape characters such as the newline "\n", which could be used to separate individual settings specified on a single line.
Seega sai ründaja määrata ühte lubatud parameetritest parameetri „leftupdown”, mis on tavakasutajatele keelatud ja käivitab skripti, mida täidetakse root õigustes ühenduse loomise protsessis. Näiteks saab programmi /bin/true käivitamiseks lubatud parameetrile „hostaddrfamily” lisada järgmised sätet: hostaddrfamily=ipv4\n leftupdown=/bin/true\n ikev2=never\n leftxauthclient=yes\n leftusername=username\n phase2alg=aes256-sha1\n authby=secret\n left=faultroute\n leftmodecfgclient=yes\n right=172.31.79.2\nconn ign
Another vulnerability has been discovered in the background process guix-daemon, used in distributions based on the GNU Guix package manager. This vulnerability poses a risk to multi-user systems and allows a local user to acquire the privileges of any user performing package builds (build user) and modify the build output. The essence of the vulnerability is that an attacker can start a derived build, and if the build process is interrupted, already created suid-files remain accessible to other users in the system. After that, the attacker can use the created suid-file to pause the build process, open any file via /proc/$PID/fd with the privileges of the user performing the build, and overwrite files with the build results.
Allikas: opennet.ru
