Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A privilege escalation flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. When establishing an iodine VPN connection, nm-iodine-service passes the user-controlled "nameserver" setting from the connection profile to the iodine client binary on the command line without an option terminator. A nameserver value prefixed with "-d" can be reinterpreted by iodine's argument parser as the TUN device name option. Iodine truncates this device name to 15 bytes when calling the kernel's TUNSETIFF ioctl, but keeps the full (up to 250-byte) string in a global buffer that is later interpolated, unsanitized, into an ifconfig command executed via system(). Because this command runs before iodine drops privileges via chroot(), setgid(), and setuid(), a local unprivileged user can embed shell metacharacters in the nameserver value of a VPN connection profile to execute arbitrary commands as root.
Liaised with Guido Gunther, who formulated a patch for it: https://gitlab.gnome.org/GNOME/network-manager-iodine/-/merge_requests/6 Rawhide build: https://koji.fedoraproject.org/koji/taskinfo?taskID=150426260 Will be pushed to f43, f44 and f45.
FEDORA-2026-ccf41b012c (NetworkManager-iodine-1.2.0-29.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-ccf41b012c
FEDORA-2026-5463db437e (NetworkManager-iodine-1.2.0-29.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-5463db437e
FEDORA-2026-d3a0471c75 (NetworkManager-iodine-1.2.0-29.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-d3a0471c75
FEDORA-2026-d3a0471c75 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d3a0471c75` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d3a0471c75 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-ccf41b012c has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-ccf41b012c` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-ccf41b012c See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-5463db437e has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-5463db437e` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-5463db437e See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-ccf41b012c (NetworkManager-iodine-1.2.0-29.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-d3a0471c75 (NetworkManager-iodine-1.2.0-29.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-5463db437e (NetworkManager-iodine-1.2.0-29.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.