CVE-2024-2357: Denial of Service in libreswan
Summary
CVE-2024-2357: The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matc... Affects libreswan versions 4.10-1 – 5.2-2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libreswan is an open-source implementation of IPsec and IKE for Linux. It provides secure communication channels over the internet by encrypting and authenticating network traffic. The libreswan package is commonly used in Debian 11 systems. However, a vulnerability has been discovered in libreswan that can lead to a Denial of Service (DoS) condition.
Vulnerability Detail
The vulnerability (CVE-2024-2357) occurs when libreswan is configured to use PreSharedKeys (authby=secret) and a connection cannot find a matching configured secret. In such cases, when a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes, resulting in a DoS. This issue can be triggered under certain IKEv2 retransmit scenarios. The impact of this vulnerability is the disruption of libreswan functionality, leading to a loss of service availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the configured secrets match the connections using PreSharedKeys (authby=secret). This can be done by carefully configuring the secrets and verifying their correctness.
Conclusion
The vulnerability in libreswan can lead to repeated crashes and a Denial of Service (DoS) condition. It is crucial for users to update their libreswan package to the latest version to mitigate the risk and ensure the security of their systems.
See every vulnerability recorded for libreswan →
FAQ
Libreswan is an open-source implementation of IPsec and IKE for Linux, providing secure communication channels over the internet.
The vulnerability can lead to repeated crashes of libreswan, causing a Denial of Service (DoS) and disrupting service availability.
To fix this vulnerability, update your libreswan package to the latest version available.
While no specific workaround is mentioned, ensuring that the configured secrets match the connections using PreSharedKeys (authby=secret) can mitigate the risk.
For more information, refer to the official CVE-2024-2357 advisory and the Libreswan Project's website.
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
