Bug 2514742

Summary: CVE-2026-19624 NetworkManager-l2tp: NetworkManager-l2tp: local privilege escalation via ipsec.conf injection [fedora-all]
Product: [Fedora] Fedora Reporter: Melissa Ing <meing>
Component: NetworkManager-l2tpAssignee: Douglas Kosovic <doug>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: rawhideCC: doug, drizt72
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["4df5018b-5d92-429d-a597-e0d5e6dc7f44"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Melissa Ing 2026-08-12 15:02:50 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

src/nm-l2tp-service.c writes attacker-controlled vpn.data values (ipsec-ike, ipsec-esp, ipsec-group-name -> leftid, ipsec-remote-id -> rightid) into the generated /run/nm-l2tp-<uuid>/ipsec.conf with no escaping: validate_one_property() only content-checks the gateway, and write_config_option() writes the value raw.

A newline in those values injects arbitrary ipsec.conf lines into a file pluto loads as root. An injected leftupdown=<cmd> is run by pluto as root on SA establishment, resulting in local privilege escalation.

Any unprivileged local user with a local login session can AddConnection+ActivateConnection an "own" L2TP profile (polkit settings.modify.own + network-control, no admin/wheel required) and obtain root code execution. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc); the libreswan and vpnc plugins already reject newlines in these values, l2tp did not.

On default SELinux-enforcing Fedora/RHEL systems the executed code runs as uid=0 but confined to ipsec_mgmt_t (a system-binary leftupdown is required there); on non-SELinux systems it is unconfined root.

Reported via coordinated disclosure by Keith Linneman (keith). Upstream maintainer Doug fixed the issue by rejecting control characters in vpn.data/vpn.secrets string values before writing config (and similarly for env variables), released in NetworkManager-l2tp 1.52.4 (EPEL8: 1.20.24), and pushed updated packages to Fedora, EPEL, and Debian on 2026-07-05.