REDHAT-BUG-2515042: High severity NetworkManager NetworkManager vulnerability
CVE-2025-9615 hardened private-connection FILE certificate and key paths in NetworkManager, but the directory-valued properties 802-1x.ca-path and phase2-ca-path were not included in that guard. An unprivileged user can set these properties on a private connection profile, and NetworkManager (running as root) passes capath/capath2 to wpasupplicant (also running as root) without the privateuser ownership check applied to the FILE-typed CA cert/key properties.
By pointing ca-path/phase2-ca-path at an attacker-controlled CA directory, an unprivileged local user can subvert WPA-Enterprise (802.1X) server certificate validation. On an existing corporate/eduroam profile, this lets an evil-twin AP pass certificate validation, allowing capture of the user's EAP credentials (e.g. MSCHAPv2 hash via hostapd-wpe in the reporter's PoC). The control case with /etc/ssl/certs was correctly rejected.
Scope: WPA-Enterprise (802.1X) networks only; not applicable to open or PSK networks. Requires an active local seat with the (typically passwordless) settings.modify.own permission; not exploitable via an inactive SSH session alone.
Reported by BreachX Zero Day Labs (BreachPoint Pvt Ltd, India) as part of a CERT-In coordinated disclosure also sent to Ubuntu Security and Debian Security, and copied to CERT-In (vdisclose.in). Internal reporter ID: CERT-IN-06-NM-CA-PATH.
Affected versions per reporter: Ubuntu NM 1.54.3, Kali 1.54.0, upstream tip 1.59.2-dev (commit 1947869) at time of report.
Reference: PSIRTSUPT-20440.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NetworkManagerto a version that resolves this vulnerability.Fixed in 1.54.3 - Upgrade
Upgrade
NetworkManagerto a version that resolves this vulnerability.Fixed in 1.54.0 - Upgrade
Upgrade
NetworkManagerto a version that resolves this vulnerability.Fixed in 1.59.2-dev (commit 1947869) - Configuration
Update NetworkManager so that directory-valued 802.1x.ca-path and phase2-ca-path are included in the hardening/guard that restricts ca-path/phase2-ca-path. This prevents an unprivileged user from setting attacker-controlled CA directories on a private connection profile and subverting WPA-Enterprise (802.1X) certificate validation.
NetworkManager private connection profile (802.1X) 802-1x.ca-path and phase2-ca-path (directory-valued properties) = Harden handling to include directory-valued properties in the private-connection FILE certificate/key path guard (enforce private_user ownership check for these settings before passing ca_path/ca_path2 to wpa_supplicant) - Compensating control
Apply the fix by updating NetworkManager, and ensure WPA-Enterprise (802.1X) certificate validation relies only on properly guarded CA paths (the /etc/ssl/certs case was correctly rejected in the control, indicating that properly protected system CA paths are the intended safe behavior).
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using WPA-Enterprise (802.1X) network profiles, such as corporate or eduroam Wi-Fi, are in scope. Open and PSK networks are not affected.
What access does an attacker need?
The attacker needs an active local seat with the typically passwordless settings.modify.own permission. An inactive SSH session alone is not sufficient.
What can exploitation enable?
An attacker can point the profile's CA directory setting at an attacker-controlled directory and cause an evil-twin access point to pass server certificate validation. This can allow capture of EAP credentials, such as an MSCHAPv2 hash.
How can I assess whether a profile may be affected?
Review private WPA-Enterprise connection profiles for use of the directory-valued 802-1x.ca-path or phase2-ca-path properties. The issue concerns attacker-controlled CA directories supplied through those properties; the reported control case using /etc/ssl/certs was rejected.