NetworkManager-libreswan plugin, which adds functionality to NetworkManager for connecting to VPNs compatible with servers based on Libreswan and Cisco IPsec, has a vulnerability (CVE-2024-9050) that can be exploited by a local user to elevate privileges. The vulnerability has been fixed in NetworkManager-libreswan update 1.2.24. You can track updates in distributions on the following pages: Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora.
The issue is caused by improper configuration checks VPN, defined by a local unprivileged user and passed directly to Libreswan when attempting to activate a connection. In particular, the plugin did not check the use of escape characters such as the newline "\n", which could be used to separate individual settings specified on a single line.
Consequently, an attacker could include as one of the allowed parameters the parameter "leftupdown", which is prohibited for unprivileged users and specifies a script executed with root privileges during the connection establishment process. For example, to launch the program /bin/true, the following settings could be attached to the allowed parameter "hostaddrfamily": hostaddrfamily=ipv4\n leftupdown=/bin/true\n ikev2=never\n leftxauthclient=yes\n leftusername=username\n phase2alg=aes256-sha1\n authby=secret\n left=faultroute\n leftmodecfgclient=yes\n right=172.31.79.2\n conn ign
Another vulnerability has been discovered in the background process guix-daemon, used in distributions based on the GNU Guix package manager. This vulnerability poses a risk to multi-user systems and allows a local user to acquire the privileges of any user performing package builds (build user) and modify the build output. The essence of the vulnerability is that an attacker can start a derived build, and if the build process is interrupted, already created suid-files remain accessible to other users in the system. After that, the attacker can use the created suid-file to pause the build process, open any file via /proc/$PID/fd with the privileges of the user performing the build, and overwrite files with the build results.
Allikas: opennet.ru
