Libreswan IKE Daemon Restart Vulnerability - CVE-2019-12312
Summary
CVE-2019-12312: In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. Affects libreswan across 2 version ranges.
< 3.27-5
< 3897683ffe3597b9e57041876c88de73dc2d04cf
Fixed in 3.27-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libreswan is an open-source implementation of the Internet Key Exchange (IKE) protocol, primarily used for establishing secure VPN connections. It is widely utilized in various Linux distributions for its robust security features and flexibility in configuration. However, the software is susceptible to a specific vulnerability that can lead to a denial of service through an unexpected restart of the IKE daemon.
Vulnerability Detail
In Libreswan version 3.27, an assertion failure can occur when an attacker initiates an IKEv2 IKE_SA_INIT exchange followed by a malformed INFORMATIONAL exchange instead of the expected IKE_AUTH exchange. This sequence triggers a NULL pointer dereference in the send_v2N_spi_response_from_state() function located in programs/pluto/ikev2_send.c, resulting in the restart of the Libreswan IKE daemon. The vulnerability poses a risk of denial of service, impacting the availability of VPN services relying on Libreswan.
How To Fix
Minimum fixed version
3.27-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libreswanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the IKE daemon by implementing firewall rules that restrict incoming connections to trusted IP addresses only. This can help mitigate the risk of exploitation until the software is updated.
Conclusion
The CVE-2019-12312 vulnerability in Libreswan poses a significant risk of denial of service due to a NULL pointer dereference that can be triggered by malformed IKEv2 exchanges. Users are strongly advised to upgrade to the fixed version to ensure the security and availability of their VPN services.
See every vulnerability recorded for libreswan →
FAQ
CVE-2019-12312 is a vulnerability in Libreswan that can cause the IKE daemon to restart due to a NULL pointer dereference triggered by malformed IKEv2 exchanges.
The CVSS score for this vulnerability is 7.5, indicating a high severity level that could lead to denial of service.
Libreswan versions prior to 3.27-5 are affected by this vulnerability.
If immediate upgrading is not possible, implement firewall rules to restrict access to the IKE daemon as a temporary workaround.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
