REDHAT-BUG-2313828: High severity libreswan vulnerability
A security issue in NM-libreswan, where we fail to sanitize the VPN configuration from a local unprivileged user and pass it directly to Libreswan.
The libreswan connection configuration is simple key=value format, but we fail to check for or escape special characters, including newlines, which makes it possible for the user to trick us to treat values as key.
Unfortunately, there's one particular key that takes an executable command as an argument: leftupdown (couldn't find more in ipsec.conf(5)). We normally use it to specify the NM-libreswan callback, that would pass L3 configuration back to NM. It can be abused to execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2313828?
The severity of REDHAT-BUG-2313828 is considered high due to the potential for local unprivileged users to manipulate VPN configurations.
How do I fix REDHAT-BUG-2313828?
To fix REDHAT-BUG-2313828, update your NM-libreswan and Libreswan to the latest patched versions provided by Red Hat.
What systems are affected by REDHAT-BUG-2313828?
Systems running NM-libreswan and Libreswan are affected by REDHAT-BUG-2313828.
What kind of attacks can exploit REDHAT-BUG-2313828?
Exploitation of REDHAT-BUG-2313828 could allow a local unprivileged user to execute arbitrary code via improperly sanitized VPN configurations.
Is there a workaround for REDHAT-BUG-2313828?
Currently, the recommended action for REDHAT-BUG-2313828 is to apply the security updates as there are no reliable workarounds available.