Bug 2225369 (CVE-2023-38712)

Summary:	CVE-2023-38712 libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dueno, rhel-crypto-maint, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libreswan 4.12	Doc Type:	If docs needed, set a value
Doc Text:	A NULL pointer dereference vulnerability was found in the Libreswan package. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state occurs. This flaw allows a malicious client or attacker to send a malformed IKEv1 Delete/Notify packet, causing a crash and restarting the libreswan pluto daemon. When sent continuously, this could lead to a denial of service attack.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2215955, 2215956, 2230238
Bug Blocks:	2225370

Description TEJ RATHI 2023-07-25 05:37:15 UTC

When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a null pointer dereference on the deleted state causes the pluto daemon to crash and restart.

https://libreswan.org/security/CVE-2023-38712/CVE-2023-38712.txt

Comment 1 TEJ RATHI 2023-07-25 06:08:23 UTC

Vulnerable versions : libreswan 3.00 - 4.11
Not vulnerable      : libreswan 4.12+

Vulnerable code was present from the first release of libreswan i.e libreswan v3.0 (likely the same vulnerability exists in all openswan versions)

Comment 2 TEJ RATHI 2023-08-09 05:29:27 UTC

This CVE is now public by upstream:

https://libreswan.org/security/CVE-2023-38712/CVE-2023-38712.txt
https://libreswan.org/security/CVE-2023-38712/CVE-2023-38712.patch

Comment 3 TEJ RATHI 2023-08-09 05:39:29 UTC

Created libreswan tracking bugs for this issue:

Affects: fedora-all [bug 2230238]