NetworkManager libreswan: Improper Control of Generation of Code ('Code Injection') (CVE-2024-9050)
A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration.
AI Analysis
Technical Summary
CVE-2024-9050 is a local privilege escalation vulnerability in NetworkManager-libreswan, specifically via the leftupdown component. This package integrates libreswan VPN software with NetworkManager and the GNOME desktop environment. Red Hat Product Security has issued an advisory (RHSA-2024:8356) describing this vulnerability and providing updated packages for Red Hat Enterprise Linux 8.6 variants, including Extended Update Support Extension, Update Services for SAP Solutions, Telecommunications Update Service, and Power LE SAP Solutions. The vulnerability is rated as important by Red Hat, and the update fixes the issue by patching the affected component.
Potential Impact
Successful exploitation of this vulnerability could allow a local attacker to escalate privileges on affected Red Hat Enterprise Linux 8.6 systems using NetworkManager-libreswan. This could lead to unauthorized administrative access or control over the system. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), indicating potential code injection or execution issues related to the leftupdown component.
Mitigation Recommendations
Red Hat has released updated NetworkManager-libreswan packages for Red Hat Enterprise Linux 8.6 variants that fix this vulnerability. Users should apply the update as described in the Red Hat advisory RHSA-2024:8356 and the referenced article https://access.redhat.com/articles/11258 to remediate the issue. No additional mitigation steps are indicated beyond applying the official patch.
NetworkManager libreswan: Improper Control of Generation of Code ('Code Injection') (CVE-2024-9050)
Description
A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration.
CVSS v3.1
Score 7.8high
Affected software
pkg:rpm/redhat/NetworkManager-libreswanRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-9050 is a local privilege escalation vulnerability in NetworkManager-libreswan, specifically via the leftupdown component. This package integrates libreswan VPN software with NetworkManager and the GNOME desktop environment. Red Hat Product Security has issued an advisory (RHSA-2024:8356) describing this vulnerability and providing updated packages for Red Hat Enterprise Linux 8.6 variants, including Extended Update Support Extension, Update Services for SAP Solutions, Telecommunications Update Service, and Power LE SAP Solutions. The vulnerability is rated as important by Red Hat, and the update fixes the issue by patching the affected component.
Potential Impact
Successful exploitation of this vulnerability could allow a local attacker to escalate privileges on affected Red Hat Enterprise Linux 8.6 systems using NetworkManager-libreswan. This could lead to unauthorized administrative access or control over the system. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), indicating potential code injection or execution issues related to the leftupdown component.
Mitigation Recommendations
Red Hat has released updated NetworkManager-libreswan packages for Red Hat Enterprise Linux 8.6 variants that fix this vulnerability. Users should apply the update as described in the Red Hat advisory RHSA-2024:8356 and the referenced article https://access.redhat.com/articles/11258 to remediate the issue. No additional mitigation steps are indicated beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:8356
- Cve Count
- 1
Threat ID: 6a3ed4cd72d29f1837ea6709
Added to database: 06/26/2026, 19:36:45 UTC
Last enriched: 06/26/2026, 19:38:12 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 109
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.