A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-9555 advisory.

    [1.2.22-4]
    - Unbreak validation of unknown keys

    [1.2.22-2]
    - Fix improper escaping of Libreswan configuration (CVE-2024-9050)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-2e8944621e advisory.

    This is an update to 1.2.24 release of NetworkManager-libreswan, the IPSec VPN plugin for NetworkManager.
    It fixes a local privilege escalation bug due to improper escaping of Libreswan configuration.
    (CVE-2024-9050)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8357 advisory.

    [1.2.4-2.0.1]
    - Fix improper escaping of Libreswan configuration [CVE-2024-9050][Orabug: 37206712]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-d20b38c63f advisory.

    This is an update to 1.2.24 release of NetworkManager-libreswan, the IPSec VPN plugin for NetworkManager.
    It fixes a local privilege escalation bug due to improper escaping of Libreswan configuration.
    (CVE-2024-9050)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-e88cc97dba advisory.

    This is an update to 1.2.24 release of NetworkManager-libreswan, the IPSec VPN plugin for NetworkManager.
    It fixes a local privilege escalation bug due to improper escaping of Libreswan configuration.
    (CVE-2024-9050)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:8353 advisory.

    * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8353 advisory.

    [1.2.10-7]
    - Unbreak validation of unknown keys

    [1.2.10-6]
    - Fix improper escaping of Libreswan configuration (CVE-2024-9050)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8355 advisory.

    This package contains software for integrating the libreswan VPN software with NetworkManager and the     GNOME desktop

    Security Fix(es):

    * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8352 advisory.

    This package contains software for integrating the libreswan VPN software with NetworkManager and the     GNOME desktop

    Security Fix(es):

    * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8354 advisory.

    This package contains software for integrating the libreswan VPN software with NetworkManager and the     GNOME desktop

    Security Fix(es):

    * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8358 advisory.

    This package contains software for integrating the libreswan VPN software with NetworkManager and the     GNOME desktop

    Security Fix(es):

    * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8353 advisory.

    This package contains software for integrating the libreswan VPN software with NetworkManager and the     GNOME desktop

    Security Fix(es):

    * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8357 advisory.

    This package contains software for integrating the libreswan VPN software with NetworkManager and the     GNOME desktop

    Security Fix(es):

    * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8356 advisory.

    This package contains software for integrating the libreswan VPN software with NetworkManager and the     GNOME desktop

    Security Fix(es):

    * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8338 advisory.

    This package contains software for integrating the libreswan VPN software with NetworkManager and the     GNOME desktop

    Security Fix(es):

    * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8312 advisory.

    This package contains software for integrating the libreswan VPN software     with NetworkManager and the GNOME desktop

    Security Fix(es):

    * NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211589	Oracle Linux 9 : NetworkManager-libreswan (ELSA-2024-9555)	Nessus	Oracle Linux Local Security Checks	high
211311	Fedora 41 : NetworkManager-libreswan (2024-2e8944621e)	Nessus	Fedora Local Security Checks	high
210718	Oracle Linux 7 : NetworkManager-libreswan (ELSA-2024-8357)	Nessus	Oracle Linux Local Security Checks	high
209923	Fedora 39 : NetworkManager-libreswan (2024-d20b38c63f)	Nessus	Fedora Local Security Checks	high
209921	Fedora 40 : NetworkManager-libreswan (2024-e88cc97dba)	Nessus	Fedora Local Security Checks	high
209630	AlmaLinux 8 : NetworkManager-libreswan (ALSA-2024:8353)	Nessus	Alma Linux Local Security Checks	high
209570	Oracle Linux 8 : NetworkManager-libreswan (ELSA-2024-8353)	Nessus	Oracle Linux Local Security Checks	high
209554	RHEL 8 : NetworkManager-libreswan (RHSA-2024:8355)	Nessus	Red Hat Local Security Checks	high
209553	RHEL 9 : NetworkManager-libreswan:1.2.14 (RHSA-2024:8352)	Nessus	Red Hat Local Security Checks	high
209552	RHEL 8 : NetworkManager-libreswan (RHSA-2024:8354)	Nessus	Red Hat Local Security Checks	high
209550	RHEL 8 : NetworkManager-libreswan (RHSA-2024:8358)	Nessus	Red Hat Local Security Checks	high
209549	RHEL 8 : NetworkManager-libreswan (RHSA-2024:8353)	Nessus	Red Hat Local Security Checks	high
209547	RHEL 7 : NetworkManager-libreswan (RHSA-2024:8357)	Nessus	Red Hat Local Security Checks	high
209546	RHEL 8 : NetworkManager-libreswan (RHSA-2024:8356)	Nessus	Red Hat Local Security Checks	high
209530	RHEL 7 : NetworkManager-libreswan (RHSA-2024:8338)	Nessus	Red Hat Local Security Checks	high
209523	RHEL 9 : NetworkManager-libreswan (RHSA-2024:8312)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-9050

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high