Bug 1031818 - IKEv2 minor check code could allow packets that crash the IKE daemon in the future
IKEv2 minor check code could allow packets that crash the IKE daemon in the f...
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: openswan (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Paul Wouters
BaseOS QE Security Team
Depends On:
  Show dependency treegraph
Reported: 2013-11-18 15:49 EST by Paul Wouters
Modified: 2014-04-07 11:10 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2014-04-07 11:10:00 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Paul Wouters 2013-11-18 15:49:06 EST
Description of problem:

During an effort to ignore IKEv2 minor version numbers as required for RFC-5996, complete parse errors of any IKE packets with version 2.1+ were mistakenly accepted for further processing. This causes a crash later on if the IKE packet is mangled (e.g. too short). Openswan turns out not to be vulnerable because it happens to abort on the mismatched IKE length versus packet length before it inspects the rest of the IKE header. And since reading an invalid IKE major aborts further parsing of the IKE header, the length remains at 0, and so it will always mismatch.

We mention this bug, because if the ike_pad= feature is ever backported from libreswan to openswan, this would actually open up a crasher (like in libreswan 3.6)

Version-Release number of selected component (if applicable):
2.6.32-12 (rhel 6.x) and 2.6.32-4 (rhel 5.1x) and upstream in openswan 2.6.38+ 

As openswan is currently not vulnerable for this bug, no release is required. However, this bug should be addressed if/when a new openswan package is going to be released - especially if the ike_pad= code is backported, which would expose this bug to a vulnerability.
Comment 1 Paul Wouters 2014-04-07 11:10:00 EDT
This code was backported already for CVE-2013-6467 and has been included in openswan-2.6.32-27.2

Note You need to log in before you can comment on or make changes to this bug.