The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswans default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.
Weakness
The product does not release or incorrectly releases a resource before it is made available for re-use.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libreswan | Libreswan | 3.22 (including) | 4.15 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | libreswan-0:4.12-2.el8_10.4 | * |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | RedHat | libreswan-0:4.5-1.el8_6.3 | * |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | RedHat | libreswan-0:4.5-1.el8_6.3 | * |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | RedHat | libreswan-0:4.5-1.el8_6.3 | * |
| Red Hat Enterprise Linux 8.8 Extended Update Support | RedHat | libreswan-0:4.9-3.el8_8.2 | * |
| Red Hat Enterprise Linux 9 | RedHat | libreswan-0:4.12-2.el9_4.1 | * |
| Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | RedHat | libreswan-0:4.6-3.el9_0.2 | * |
| Red Hat Enterprise Linux 9.2 Extended Update Support | RedHat | libreswan-0:4.9-5.el9_2.2 | * |
| Red Hat OpenShift Container Platform 4.15 | RedHat | libreswan-0:4.6-3.el9_0.3 | * |
| Red Hat OpenShift Container Platform 4.16 | RedHat | libreswan-0:4.6-3.el9_0.3 | * |
| Red Hat OpenShift Container Platform 4.17 | RedHat | libreswan-0:4.6-3.el9_0.3 | * |
| Libreswan | Ubuntu | focal | * |
| Libreswan | Ubuntu | mantic | * |
| Libreswan | Ubuntu | oracular | * |
| Libreswan | Ubuntu | plucky | * |
Potential Mitigations
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/125.html
- https://cwe.mitre.org/data/definitions/130.html
- https://cwe.mitre.org/data/definitions/131.html
- https://cwe.mitre.org/data/definitions/494.html
- https://cwe.mitre.org/data/definitions/495.html
- https://cwe.mitre.org/data/definitions/496.html
- https://cwe.mitre.org/data/definitions/666.html