The vulnerability in NetworkManager-libreswan stems from improper sanitization of VPN configuration data provided by local unprivileged users. The configuration uses a key-value format, but special characters are not escaped, causing the application to misinterpret values as keys. The 'leftupdown' key, which specifies an executable command callback, can be exploited by a malicious user to execute arbitrary code with root privileges via NetworkManager's use of Polkit for network configuration control. This leads to local privilege escalation and potential full system compromise. Red Hat has published multiple advisories with patches for affected versions, primarily for Red Hat Enterprise Linux 7.7 and 9.0 variants.

Successful exploitation allows a local unprivileged user to escalate privileges to root by injecting malicious commands through the VPN configuration. This results in full system compromise with high confidentiality, integrity, and availability impact. The CVSS v3.1 base score is 7.8 (High), reflecting the ease of exploitation with low attack complexity and no user interaction required.

Red Hat has released official security updates addressing CVE-2024-9050 for NetworkManager-libreswan on affected Red Hat Enterprise Linux versions (notably 7.7 and 9.0). Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisories. Patch status is confirmed as official-fix via Red Hat advisories.