REDHAT-BUG-2533634: High severity NetworkManager NetworkManager-iodine vulnerability
A privilege escalation flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. When establishing an iodine VPN connection, nm-iodine-service passes the user-controlled "nameserver" setting from the connection profile to the iodine client binary on the command line without an option terminator. A nameserver value prefixed with "-d" can be reinterpreted by iodine's argument parser as the TUN device name option. Iodine truncates this device name to 15 bytes when calling the kernel's TUNSETIFF ioctl, but keeps the full (up to 250-byte) string in a global buffer that is later interpolated, unsanitized, into an ifconfig command executed via system(). Because this command runs before iodine drops privileges via chroot(), setgid(), and setuid(), a local unprivileged user can embed shell metacharacters in the nameserver value of a VPN connection profile to execute arbitrary commands as root.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local unprivileged user who can control the "nameserver" value in an iodine VPN connection profile can exploit it. Exploitation occurs when an iodine VPN connection is established using that profile.
What input is required to trigger command execution?
The attacker-controlled nameserver value must begin with "-d" so iodine interprets it as a TUN device name option. Shell metacharacters embedded in the value can then reach an unsanitized ifconfig command.
What privilege level can successful exploitation achieve?
Successful exploitation can execute arbitrary commands as root. The vulnerable command is executed before iodine performs its chroot, setgid, and setuid privilege-dropping steps.