Networkmanager L2Tp
Monthly
Local privilege escalation to root in NetworkManager-l2tp: a local user who holds NetworkManager VPN-connection-creation permission (typically granted through polkit on a desktop or shared Linux host) can smuggle an arbitrary pppd 'plugin' directive into the root-owned pppd options file by setting the L2TP connection's mru or mtu property to a valid integer followed by trailing non-numeric text, for example '1400 plugin /tmp/evil.so'. Because the plugin directive is consumed by the privileged pppd process when the crafted VPN connection is activated, pppd loads an attacker-controlled shared object and executes code as root. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation, and the flaw is strictly local with no remote or network-facing exposure; the practical bar is the PR:L gate, since an ordinary unprivileged account cannot trigger it unless it has been given VPN management rights.
Local privilege escalation to root in NetworkManager-l2tp: a local user who holds NetworkManager VPN-connection-creation permission (typically granted through polkit on a desktop or shared Linux host) can smuggle an arbitrary pppd 'plugin' directive into the root-owned pppd options file by setting the L2TP connection's mru or mtu property to a valid integer followed by trailing non-numeric text, for example '1400 plugin /tmp/evil.so'. Because the plugin directive is consumed by the privileged pppd process when the crafted VPN connection is activated, pppd loads an attacker-controlled shared object and executes code as root. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation, and the flaw is strictly local with no remote or network-facing exposure; the practical bar is the PR:L gate, since an ordinary unprivileged account cannot trigger it unless it has been given VPN management rights.