Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2574

NIXPKGS-2026-2574

GitHub issue published 9 hours ago

NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

Permalink CVE-2026-19624

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 13 hours ago
@LeSuisse ignored
16 packages
- fedora-backgrounds.f32
- fedora-backgrounds.f33
- fedora-backgrounds.f34
- fedora-backgrounds.f35
- fedora-backgrounds.f36
- fedora-backgrounds.f37
- fedora-backgrounds.f38
- haskellPackages.fedora-krb
- haskellPackages.fedora-dists
- haskellPackages.fedora-releases
- python313Packages.python-fedora
- python314Packages.python-fedora
- python313Packages.fedora-messaging
- python314Packages.fedora-messaging
- haskellPackages.fedora-haskell-tools
- gnomeExtensions.fedora-linux-update-indicator
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive; pluto executes that command as root when the IKE security association is established, resulting in local privilege escalation. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc).

References

https://github.com/nm-l2tp/NetworkManager-l2tp/commit/95b6b46f48a0c9eabc79272cd… patch
https://github.com/nm-l2tp/NetworkManager-l2tp/commit/3704d8c9d5e5f9ed1626a8ce7… patch
https://github.com/nm-l2tp/NetworkManager-l2tp/releases release-notes
https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp vendor-advisory
https://linnemanlabs.com/posts/nm-l2tp-newline-to-root/ third-party-advisory

Affected products

NetworkManager-l2tp

<1.20.24
<1.8.10
<1.2.22
<1.0.16
<1.52.4

Matching in nixpkgs

pkgs.networkmanager-l2tp

L2TP plugin for NetworkManager

nixos-unstable 1.52.0
- nixpkgs-unstable 1.52.0
- nixos-unstable-small 1.52.0
nixos-26.05 1.52.0
- nixos-26.05-small 1.52.0
- nixpkgs-26.05-darwin 1.52.0

Ignored packages (16)

pkgs.fedora-backgrounds.f32

Set of default and supplemental wallpapers for Fedora

nixos-unstable 32.2.2
- nixpkgs-unstable 32.2.2
- nixos-unstable-small 32.2.2
nixos-26.05 32.2.2
- nixos-26.05-small 32.2.2
- nixpkgs-26.05-darwin 32.2.2

pkgs.fedora-backgrounds.f33

Set of default and supplemental wallpapers for Fedora

nixos-unstable 33.0.7
- nixpkgs-unstable 33.0.7
- nixos-unstable-small 33.0.7
nixos-26.05 33.0.7
- nixos-26.05-small 33.0.7
- nixpkgs-26.05-darwin 33.0.7

pkgs.fedora-backgrounds.f34

Set of default and supplemental wallpapers for Fedora

nixos-unstable 34.0.1
- nixpkgs-unstable 34.0.1
- nixos-unstable-small 34.0.1
nixos-26.05 34.0.1
- nixos-26.05-small 34.0.1
- nixpkgs-26.05-darwin 34.0.1

pkgs.fedora-backgrounds.f35

Set of default and supplemental wallpapers for Fedora

nixos-unstable 35.0.1
- nixpkgs-unstable 35.0.1
- nixos-unstable-small 35.0.1
nixos-26.05 35.0.1
- nixos-26.05-small 35.0.1
- nixpkgs-26.05-darwin 35.0.1

pkgs.fedora-backgrounds.f36

Set of default and supplemental wallpapers for Fedora

nixos-unstable 36.1.2
- nixpkgs-unstable 36.1.2
- nixos-unstable-small 36.1.2
nixos-26.05 36.1.2
- nixos-26.05-small 36.1.2
- nixpkgs-26.05-darwin 36.1.2

pkgs.fedora-backgrounds.f37

Set of default and supplemental wallpapers for Fedora

nixos-unstable 37.0.5
- nixpkgs-unstable 37.0.5
- nixos-unstable-small 37.0.5
nixos-26.05 37.0.5
- nixos-26.05-small 37.0.5
- nixpkgs-26.05-darwin 37.0.5

pkgs.fedora-backgrounds.f38

Set of default and supplemental wallpapers for Fedora

nixos-unstable 38.1.1
- nixpkgs-unstable 38.1.1
- nixos-unstable-small 38.1.1
nixos-26.05 38.1.1
- nixos-26.05-small 38.1.1
- nixpkgs-26.05-darwin 38.1.1

pkgs.haskellPackages.fedora-krb

Kerberos for Fedora packagers

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
- nixos-unstable-small 0.1.0
nixos-26.05 0.1.0
- nixos-26.05-small 0.1.0
- nixpkgs-26.05-darwin 0.1.0

pkgs.haskellPackages.fedora-dists

Library for Fedora distribution versions

nixos-unstable 2.1.1
- nixpkgs-unstable 2.1.1
- nixos-unstable-small 2.1.1
nixos-26.05 2.1.1
- nixos-26.05-small 2.1.1
- nixpkgs-26.05-darwin 2.1.1

pkgs.haskellPackages.fedora-releases

Library for Fedora release versions

nixos-unstable 0.3.0
- nixpkgs-unstable 0.3.0
- nixos-unstable-small 0.3.0
nixos-26.05 0.3.0
- nixos-26.05-small 0.3.0
- nixpkgs-26.05-darwin 0.3.0

pkgs.python313Packages.python-fedora

Module to interact with the infrastructure of the Fedora Project

nixos-unstable 1.1.1
- nixpkgs-unstable 1.1.1
- nixos-unstable-small 1.1.1
nixos-26.05 1.1.1
- nixos-26.05-small 1.1.1
- nixpkgs-26.05-darwin 1.1.1

pkgs.python314Packages.python-fedora

Module to interact with the infrastructure of the Fedora Project

nixos-unstable 1.1.1
- nixpkgs-unstable 1.1.1
- nixos-unstable-small 1.1.1
nixos-26.05 1.1.1
- nixos-26.05-small 1.1.1
- nixpkgs-26.05-darwin 1.1.1

pkgs.python313Packages.fedora-messaging

Library for sending AMQP messages with JSON schema in Fedora infrastructure

nixos-unstable 3.9.1
- nixpkgs-unstable 3.9.1
- nixos-unstable-small 3.9.1
nixos-26.05 3.9.0
- nixos-26.05-small 3.9.0
- nixpkgs-26.05-darwin 3.9.0

pkgs.python314Packages.fedora-messaging

Library for sending AMQP messages with JSON schema in Fedora infrastructure

nixos-unstable 3.9.1
- nixpkgs-unstable 3.9.1
- nixos-unstable-small 3.9.1
nixos-26.05 3.9.0
- nixos-26.05-small 3.9.0
- nixpkgs-26.05-darwin 3.9.0

pkgs.haskellPackages.fedora-haskell-tools

Building and maintenance tools for Fedora Haskell

nixos-unstable 1.2
- nixpkgs-unstable 1.2
- nixos-unstable-small 1.2
nixos-26.05 1.2
- nixos-26.05-small 1.2
- nixpkgs-26.05-darwin 1.2

pkgs.gnomeExtensions.fedora-linux-update-indicator

GNOME Shell update indicator for Fedora Linux.

nixos-unstable 41
- nixpkgs-unstable 41
- nixos-unstable-small 45
nixos-26.05 41
- nixos-26.05-small 41
- nixpkgs-26.05-darwin 41

Package maintainers

@obadz obadz <obadz-nixos@obadz.com>