Libreswan Vulnerability: IKEv2 Child SA REKEY Packet Crash Issue
Summary
DEBIAN-CVE-2023-38710: An issue was discovered in Libreswan before 4.12. Affects libreswan versions < 4.12-1. Fixed in 4.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libreswan is an open-source implementation of the Internet Key Exchange (IKE) and IPsec protocols, primarily used for creating secure VPN connections. It provides functionalities such as encryption, authentication, and secure data transfer over the internet. The package is widely utilized in various Linux distributions, including Debian. However, a vulnerability has been identified that affects its stability and reliability, particularly in handling specific IKEv2 packets.
Vulnerability Detail
An issue was discovered in Libreswan before version 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, the system sends back an error notify INVALID_SPI. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH (3). This flaw leads to the pluto daemon crashing and restarting, potentially disrupting VPN services and compromising network security.
How To Fix
Minimum fixed version
4.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libreswanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure your system to avoid sending invalid IPsec protocol ID numbers in IKEv2 packets. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The identified vulnerability in Libreswan poses a significant risk to the stability of VPN services. Users are strongly encouraged to update to the latest version to mitigate this issue. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring better security for your applications.
See every vulnerability recorded for libreswan →
FAQ
The vulnerability can cause the pluto daemon to crash, leading to potential disruptions in VPN services.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
Versions of Libreswan prior to 4.12 are affected by this vulnerability.
Yes, updating to version 4.12-1 or later will permanently fix the vulnerability.
If you cannot update immediately, consider implementing a workaround by avoiding the use of invalid IPsec protocol ID numbers in IKEv2 packets.
References
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
