PT-2024-4388 · Libreswan+6 · Libreswan+6
David Morel
·
Published
2024-04-10
·
Updated
2024-10-29
·
CVE-2024-3652
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Libreswan versions prior to 4.15
Description
The issue is related to the Libreswan library, which is used for VPN protocols with "IPsec". It is caused by an assertion failure when handling IKEv1 packets without specifying an esp= line. When a peer requests AES-GMAC, libreswan's default proposal handler causes the failure, leading to a crash and restart. This issue does not affect IKEv2 connections. The vulnerability can be exploited by a remote attacker to cause a denial of service.
Recommendations
For Libreswan versions prior to 4.15, update to version 4.15 or later to resolve the issue. As a temporary workaround, consider disabling the use of IKEv1 without specifying an esp= line until a patch is available. Restrict access to the default proposal handler to minimize the risk of exploitation. Avoid using AES-GMAC with IKEv1 until the issue is resolved.
Fix
Improper Resource Release
Assertion Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Libreswan
Red Hat
Red Os
Rocky Linux