Описание
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
NetworkManager-l2tp writes attacker-controlled VPN connection properties (vpn.data / vpn.secrets values) unescaped into a generated ipsec.conf file loaded by pluto as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive, which pluto executes as root on SA establishment, resulting in local privilege escalation.
Отчет
The vulnerable code paths predate the fix versions by several years and span all five maintained branches (1.0.x, 1.2.x, 1.8.x, 1.20.x, 1.52.x). The ipsec-ike/ipsec-esp/ipsec-group-name properties have never been content-validated in validate_one_property() (unconditional "return; /* valid */") since these options were added upstream in commit b10d9c72bf (2017-03-26), predating all current fix versions. The ipsec-remote-id/ipsec-gateway-id (rightid) validation via validate_gateway_id() was removed upstream in commit 99851333b1 (2019-03-05) for the 1.2.x/1.8.x/1.20.x/1.52.x branches; the 1.0.x branch still carries validate_gateway_id(), but that check only inspects the first character of the identity ('@' == id[0]) and does not validate any subsequent characters, so a crafted identity such as "@x\nleftupdown=..." likely bypasses it as well. No Red Hat product other than the Fedora/EPEL community builds ships NetworkManager-l2tp.
Меры по смягчению последствий
Upgrade to a fixed NetworkManager-l2tp version, which rejects control characters (including newlines) in vpn.data/vpn.secrets string values before writing them into ipsec.conf. Fixed versions per branch: >= 1.0.16, >= 1.2.22, >= 1.8.10, >= 1.20.24 (EPEL8), >= 1.52.4.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-co ...
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).
EPSS
7.8 High
CVSS3