Denial of Service Vulnerability in Libreswan 4.9: Remote Attack via Crafted TS Payload
Summary
CVE-2023-23009: Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length. Affects libreswan across 2 version ranges.
< 4.3-1+deb11u3
< 394c823abbf8af6afaf6c9c71fb53fca775bfae7
Fixed in 4.3-1+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libreswan is an open-source implementation of the Internet Key Exchange (IKE) and IPsec protocols, which are essential for establishing secure virtual private networks (VPNs). It is widely used for creating secure connections over the internet, providing confidentiality, integrity, and authenticity of data. The package is known for its robust security features and flexibility, but it is susceptible to specific vulnerabilities that can be exploited by attackers.
Vulnerability Detail
The vulnerability identified as CVE-2023-23009 in Libreswan 4.9 allows remote attackers to trigger a denial of service condition. This occurs through the sending of a crafted Traffic Selector (TS) payload with an incorrect selector length. When the daemon encounters this malformed payload, it results in an assertion failure, leading to a restart of the daemon. This can disrupt service availability and potentially expose sensitive data during the downtime. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
4.3-1+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libreswanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing network-level protections such as firewalls to filter incoming traffic and prevent the exploitation of this vulnerability. Additionally, monitoring logs for unusual activity can help identify potential attacks.
Conclusion
CVE-2023-23009 represents a significant denial of service vulnerability in Libreswan 4.9, which can be exploited by remote attackers through malformed Traffic Selector payloads. Users are strongly advised to upgrade to the latest versions to protect their systems. For those unable to upgrade immediately, implementing workarounds and monitoring can help mitigate risks.
See every vulnerability recorded for libreswan →
FAQ
CVE-2023-23009 is a vulnerability in Libreswan 4.9 that allows remote attackers to cause a denial of service through crafted Traffic Selector payloads.
Exploitation of this vulnerability can lead to service interruptions, as the daemon may crash and restart, affecting the availability of secure connections.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Libreswan versions prior to 4.3-1+deb11u3 for Debian 11 and prior to 4.9-2 for Debian 12 are affected by this vulnerability.
If an upgrade is not possible, implement network-level protections and monitor for unusual activity to mitigate potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
