Vulnerability in libreswan package: Assertion Failure and Restart
Summary
CVE-2024-3652: The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. Affects libreswan versions >= 8c50902106b3c36e882ae5611155475c6f4c0222, < 960fdc2d5f17cd049a56c257b738bb964cea3eb5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libreswan package is a popular open-source implementation of IPsec for Linux. It provides a secure communication channel by encrypting and authenticating network traffic. Libreswan supports both IKEv1 and IKEv2 protocols for key exchange and security associations. However, a vulnerability has been discovered in libreswan that causes the software to restart under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2024-3652, occurs when using IKEv1 without specifying an esp= line. In such cases, if the peer requests AES-GMAC, libreswan's default proposal handler triggers an assertion failure, leading to a crash and subsequent restart of the software. This issue does not affect IKEv2 connections. The vulnerability poses a risk of service disruption and potential denial-of-service attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid the vulnerability by explicitly specifying the esp= line in the IPsec configuration for IKEv1 connections. For example, if AES-GMAC is desired, the configuration should include 'esp=aes_gmac'. This ensures that libreswan does not encounter the assertion failure and avoids the subsequent crash and restart.
Conclusion
The vulnerability in libreswan, identified as CVE-2024-3652, can cause the software to crash and restart when using IKEv1 without specifying an esp= line and encountering a request for AES-GMAC. This issue does not affect IKEv2 connections. It is crucial to update the libreswan package to a patched version and review the IPsec configuration to mitigate the risk of service disruption and potential denial-of-service attacks.
See every vulnerability recorded for libreswan →
FAQ
Libreswan is an open-source implementation of IPsec for Linux, providing secure communication channels through encryption and authentication of network traffic.
The vulnerability in libreswan can lead to service disruption and potential denial-of-service attacks when using IKEv1 without specifying an esp= line and encountering a request for AES-GMAC.
No, IKEv2 connections are not affected by this vulnerability. The issue only pertains to IKEv1 connections without proper esp= line specification.
To fix this vulnerability, update the libreswan package to the latest version available for your distribution. Additionally, review and update the IPsec configuration to ensure proper esp= line specification for IKEv1 connections.
Yes, a temporary workaround is to explicitly specify the esp= line in the IPsec configuration for IKEv1 connections. This can be done by adding 'esp=aes_gmac' to the configuration to avoid triggering the assertion failure.
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
