A NetworkManager-libreswan plugin, which adds VPN connectivity functionality compatible with servers based on Libreswan and Cisco IPsec, has a vulnerability (CVE-2024-9050) that can be exploited by local users to elevate their privileges. The vulnerability has been fixed in NetworkManager-libreswan version 1.2.24. You can track updates in the distributions on the following pages: Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora.
The issue is caused by incorrect configuration checking VPN, defined by a local unprivileged user and passed directly to Libreswan when attempting to activate a connection. In particular, the plugin did not perform checking for escape characters, such as newline "\n", which could be used to separate individual settings specified in one line.
Ennek megfelelően a támadó megadhatott egy engedélyezett paraméter egyikében egy olyan paramétert, mint a „leftupdown”, amelyet nem privilegizált felhasználók számára tiltanak, és amely egy root jogosultságokkal végrehajtott szkriptet definiál a kapcsolat létrehozásakor. Például a "/bin/true" program indításához a „hostaddrfamily” engedélyezett paraméterhez az alábbi beállításokat lehet csatolni: hostaddrfamily=ipv4\n leftupdown=\/bin\/true\n ikev2=never\n leftxauthclient=yes\n leftusername=username\n phase2alg=aes256-sha1\n authby=secret\n left=faultroute\n leftmodecfgclient=yes\n right=172.31.79.2\nconn ign
Another vulnerability has been identified in the background process guix-daemon used in distributions based on the GNU Guix package manager. This vulnerability poses a risk to multi-user systems and allows a local user to gain privileges of any user compiling packages (build user) and modify the build output. The essence of the vulnerability is that the attacker can start a derivative build, and if the build process is interrupted, the already created suid-files remain accessible to other users in the system. After that, the attacker can use the created suid-file to pause the build process, open any file through /proc/$PID/fd with the privileges of the user compiling and overwrite files with the build results.
Forrás: opennet.ru
