Ubuntu: 6851-1 High Severity: Netplan Command Injection Risk

ubuntu

June 26, 2024

Netplan could reveal secrets or execute commands with specially crafted configuration file.

Summary

Netplan could reveal secrets or execute commands with specially crafted

configuration file.

Software Description:

- netplan.io: Declarative network configuration for various backends

Details:

Andreas Hasenack discovered that netplan incorrectly handled the permissions

for netdev files containing wireguard configuration. An attacker could use this to obtain

wireguard secret keys.

It was discovered that netplan configuration could be manipulated into injecting

arbitrary commands while setting up network interfaces. An attacker could

use this to execute arbitrary commands or escalate privileges.

Topics Covered

security advisory high severity Ubuntu network configuration command injection secret exposure netplan

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  libnetplan1                     1.0-2ubuntu1.1
  netplan-generator               1.0-2ubuntu1.1
  netplan.io                      1.0-2ubuntu1.1

Ubuntu 23.10
  libnetplan0                     0.107-5ubuntu0.3
  netplan-generator               0.107-5ubuntu0.3
  netplan.io                      0.107-5ubuntu0.3

Ubuntu 22.04 LTS
  libnetplan0                     0.106.1-7ubuntu0.22.04.3
  netplan.io                      0.106.1-7ubuntu0.22.04.3

Ubuntu 20.04 LTS
  libnetplan0                     0.104-0ubuntu2~20.04.5
  netplan.io                      0.104-0ubuntu2~20.04.5

After a standard system update you need to reboot your computer to make
all the necessary changes.