Skip to content
Fencer Vulns
high 7.8

CVE-2024-9050 json

Networkmanager-libreswan: local privilege escalation via leftupdown

published 2024-10-22 2 y ago modified 2026-11-04 4 d ago also EUVD-2024-50427

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 7.7 Advanced Update Support 0:1.2.4-4.el7_7
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.2.4-4.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:1.2.10-7.el8_10
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:1.2.10-6.el8_2
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.2.10-6.el8_4
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 0:1.2.10-6.el8_4
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 0:1.2.10-6.el8_4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:1.2.10-6.el8_6
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:1.2.10-6.el8_6
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:1.2.10-6.el8_6
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 0:1.2.10-6.el8_8
  • Red Hat Red Hat Enterprise Linux 9 0:1.2.22-4.el9_5
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:1.2.14-3.el9_0
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 0:1.2.14-6.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:1.2.18-6.el9_4
  • NetworkManager-libreswan RHEL 9 1.2.22-4.el9_5
  • NetworkManager-libreswan-gnome RHEL 9 1.2.22-4.el9_5
  • NetworkManager-libreswan RHEL 8 1.2.10-7.el8_10
  • NetworkManager-libreswan-gnome RHEL 8 1.2.10-7.el8_10
  • NetworkManager-libreswan RHEL 9.4 EUS 1.2.18-6.el9_4
  • NetworkManager-libreswan-gnome RHEL 9.4 EUS 1.2.18-6.el9_4
  • NetworkManager-libreswan RHEL 9.2 EUS 1.2.14-6.el9_2
  • NetworkManager-libreswan-gnome RHEL 9.2 EUS 1.2.14-6.el9_2

red hat advisories RHSA-2024:9556RHSA-2024:9555RHSA-2024:8352RHSA-2024:8353RHSA-2024:8355RHSA-2024:8354

  • NetworkManager-libreswan openSUSE Tumbleweed 1.2.24-1.1

opensuse advisories openSUSE-SU-2024:14422-1

  • NetworkManager-libreswan AlmaLinux 9 1.2.22-4.el9_5
  • NetworkManager-libreswan-gnome AlmaLinux 9 1.2.22-4.el9_5
  • NetworkManager-libreswan AlmaLinux 8 1.2.10-7.el8_10
  • NetworkManager-libreswan-gnome AlmaLinux 8 1.2.10-7.el8_10

almalinux advisories ALSA-2024:9555ALSA-2024:8353

  • NetworkManager-libreswan Rocky Linux 8 1.2.10-7.el8_10
  • NetworkManager-libreswan Rocky Linux 9 1.2.22-4.el9_5

rocky linux advisories RLSA-2024:8353RLSA-2024:9555

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-9050 updated cvss 7.8

NetworkManager-libreswan: Local privilege escalation via leftupdown

  • Red Hat Enterprise Linux 10 NetworkManager-libreswan
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) NetworkManager-libreswan 1.2.10-7.el8_10, NetworkManager-libreswan-gnome 1.2.10-7.el8_10
    fixed: vendor fix RHSA-2024:8353
  • Red Hat Enterprise Linux AppStream (v. 9) NetworkManager-libreswan 1.2.22-4.el9_5, NetworkManager-libreswan-gnome 1.2.22-4.el9_5
    fixed: vendor fix RHSA-2024:9555
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) NetworkManager-libreswan 1.2.10-6.el8_2, NetworkManager-libreswan-gnome 1.2.10-6.el8_2
    fixed: vendor fix RHSA-2024:8358
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) NetworkManager-libreswan 1.2.10-6.el8_4, NetworkManager-libreswan-gnome 1.2.10-6.el8_4
    fixed: vendor fix RHSA-2024:8355
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) NetworkManager-libreswan 1.2.10-6.el8_6, NetworkManager-libreswan-gnome 1.2.10-6.el8_6
    fixed: vendor fix RHSA-2024:8356
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) NetworkManager-libreswan 1.2.10-6.el8_4, NetworkManager-libreswan-gnome 1.2.10-6.el8_4
    fixed: vendor fix RHSA-2024:8355
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) NetworkManager-libreswan 1.2.10-6.el8_6, NetworkManager-libreswan-gnome 1.2.10-6.el8_6
    fixed: vendor fix RHSA-2024:8356
show 8 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) NetworkManager-libreswan 1.2.14-3.el9_0, NetworkManager-libreswan-gnome 1.2.14-3.el9_0
    fixed: vendor fix RHSA-2024:8312
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) NetworkManager-libreswan 1.2.10-6.el8_8, NetworkManager-libreswan-gnome 1.2.10-6.el8_8
    fixed: vendor fix RHSA-2024:8354
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) NetworkManager-libreswan 1.2.14-6.el9_2, NetworkManager-libreswan-gnome 1.2.14-6.el9_2
    fixed: vendor fix RHSA-2024:8352
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) NetworkManager-libreswan 1.2.18-6.el9_4, NetworkManager-libreswan-gnome 1.2.18-6.el9_4
    fixed: vendor fix RHSA-2024:9556
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) NetworkManager-libreswan 1.2.10-6.el8_4, NetworkManager-libreswan-gnome 1.2.10-6.el8_4
    fixed: vendor fix RHSA-2024:8355
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) NetworkManager-libreswan 1.2.10-6.el8_6, NetworkManager-libreswan-gnome 1.2.10-6.el8_6
    fixed: vendor fix RHSA-2024:8356
  • Red Hat Enterprise Linux Server (v. 7 ELS) NetworkManager-libreswan 1.2.4-4.el7_9, NetworkManager-libreswan-gnome 1.2.4-4.el7_9
    fixed: vendor fix RHSA-2024:8357
  • Red Hat Enterprise Linux Server AUS (v. 7.7) NetworkManager-libreswan 1.2.4-4.el7_7, NetworkManager-libreswan-gnome 1.2.4-4.el7_7
    fixed: vendor fix RHSA-2024:8338

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 7.7 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 10

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.