Denial of Service Vulnerability in Libreswan: Remote Attack via Crafted TS Payload
Summary
DEBIAN-CVE-2023-23009: Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length. Affects libreswan versions < 4.3-1+deb11u3. Fixed in 4.3-1+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libreswan is an open-source implementation of the Internet Key Exchange (IKE) and IPsec protocols, primarily used for establishing secure VPN connections. It is widely utilized in various Linux distributions, including Debian. The package is known for its robust security features and flexibility in configuration, making it a popular choice for secure communications. However, it is susceptible to specific vulnerabilities that can be exploited by remote attackers.
Vulnerability Detail
Libreswan version 4.9 contains a vulnerability that allows remote attackers to trigger a denial of service (DoS) condition. This is achieved through the sending of crafted Traffic Selector (TS) payloads with an incorrect selector length. When the daemon encounters such payloads, it results in an assertion failure, causing the service to restart unexpectedly. This vulnerability can disrupt services relying on Libreswan for secure communications, leading to potential downtime and loss of availability.
How To Fix
Minimum fixed version
4.3-1+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libreswanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing network-level controls to filter out malformed TS payloads or limit access to the Libreswan service to trusted IP addresses only. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The vulnerability in Libreswan presents a significant risk of denial of service through crafted TS payloads. It is crucial for users to update to the latest patched versions to ensure the security and availability of their services. Additionally, temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for libreswan →
FAQ
The vulnerability allows remote attackers to cause a denial of service by sending crafted TS payloads with incorrect selector lengths.
Libreswan versions prior to 4.3-1+deb11u3 for Debian 11 and prior to 4.9-2 for Debian 12, 13, and 14 are affected.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Exploitation of this vulnerability can lead to service disruptions, causing the Libreswan daemon to restart and potentially affecting secure communications.
Yes, you can implement network-level controls to filter out malformed payloads or restrict access to the service until an update is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
