CVE-2024-3652: IKEv1 default AH/ESP responder can cause libreswan to abort and restart
IKEv1 default AH/ESP responder can cause libreswan to abort and restart
Other sources
libreswan can crash and restart when it is acting as an IKEv1 responder with AH/ESP default setting, when no esp= line is present in the connection configuration. The bug is triggered when after IKEv1 authentication has succeeded (via Main Mode or Aggressive Mode), a Quick Mode message is received containing a bogus AES-GMAC proposal.
When such a connection is automatically added on startup using the auto=keyword, it can cause repeated crashes leading to a Denial of Service. No Remote Code Execution is possible. IKEv2 connections are not vulnerable.
Vulnerable versions : libreswan 3.22 - 4.14
https://libreswan.org/security/CVE-2024-3652 https://github.com/libreswan/libreswan/issues/1665
— Red Hat
The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libreswanto a version that resolves this vulnerability.Fixed in 4.15 - Upgrade
Upgrade
redhat/libreswanto a version that resolves this vulnerability.Fixed in 5.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.15-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.14-2 - Upgrade
Upgrade
libreswanto a version that resolves this vulnerability.Fixed in 4.15 - Configuration
For IKEv1 connections where Libreswan acts as a responder, ensure the connection configuration includes an explicit esp= line; do not rely on the default AH/ESP responder behavior when esp= is not present, since this can trigger repeated crashes/DoS when a bogus AES-GMAC Quick Mode proposal is received.
Libreswan connection configuration (IKEv1) esp= = must be explicitly specified (add an esp= line)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3652?
CVE-2024-3652 has been classified as a high severity vulnerability due to its potential to cause crashes in the libreswan software.
How do I fix CVE-2024-3652?
To fix CVE-2024-3652, update libreswan to version 4.15 or 5.0.
What environments are affected by CVE-2024-3652?
CVE-2024-3652 affects libreswan when it is configured as an IKEv1 responder without an esp= line in the connection configuration.
What actions trigger CVE-2024-3652?
CVE-2024-3652 is triggered after successful IKEv1 authentication if a Quick Mode message is processed without the necessary configuration.
Is CVE-2024-3652 exploitable remotely?
Yes, CVE-2024-3652 can be exploited remotely if the attacker can interact with the libreswan service.