## Summary
CVE-2026-19624 is a local privilege escalation in NetworkManager-l2tp where attacker-controlled L2TP VPN properties are written unescaped into an ipsec.conf file that pluto (Libreswan) loads as root. A local unprivileged user can inject a newline to add a malicious leftupdown directive, causing root command execution when the IKE security association is established.
## Technical Details
- Root cause: NetworkManager-l2tp writes VPN connection properties (notably vpn.data / vpn.secrets) into generated ipsec.conf without escaping control characters/newlines.
- Exploit primitive: newline injection allows breaking out of the intended config value and adding a new directive (e.g., leftupdown).
- Execution: pluto loads the generated ipsec.conf as root; the injected leftupdown directive is executed as root when the IKE SA is established.
- Patch direction (from repo commits): added string_contains_control_char() and validation to reject control characters for string properties and environment-derived debug settings (e.g., PLUTODEBUG, CHARONDEBUG).
- Related hardening: release notes also mention other local root escalation fixes involving quote break-out and trailing string injection into /run/nm-l2tp-<uuid>/ppp-options.
## Affected
- NetworkManager-l2tp (L2TP plugin for NetworkManager), specifically the code path that generates ipsec.conf for Libreswan/pluto.
- Affected versions are not explicitly enumerated in the provided references.
## Impact
- Local unprivileged user can achieve root via config injection.
- Potential unauthenticated-to-local escalation (requires local ability to create/activate an L2TP VPN profile).
- Attack chain (high level): create L2TP profile → inject newline/control characters into properties → ipsec.conf generation → pluto loads config as root → injected directive executed.
## Mitigation
1. Upgrade NetworkManager-l2tp to a version that includes the control-character validation fixes (the repo shows security fixes merged into releases such as 1.8.12, 1.2.24, 1.0.18).
2. If immediate upgrade is not possible, restrict who can create/activate NetworkManager VPN profiles (limit local access to the NetworkManager D-Bus/UI paths used to add L2TP connections).
3. Monitor for suspicious L2TP profile creation/activation and for unexpected ipsec.conf/leftupdown-related content in the generated config under the plugin’s runtime directories.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-88