Bug 1031830 (CVE-2013-4564) - CVE-2013-4564 libreswan: DoS due to how mangled IKE packets are handled
Summary: CVE-2013-4564 libreswan: DoS due to how mangled IKE packets are handled
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2013-4564
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20131118,repor...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-11-18 21:50 UTC by Vincent Danen
Modified: 2019-06-08 19:47 UTC (History)
2 users (show)

Fixed In Version: libreswan 3.7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-11-18 23:17:56 UTC


Attachments (Terms of Use)

Description Vincent Danen 2013-11-18 21:50:19 UTC
As noted in bug #1031818, libreswan suffers from a problem with the new ike_pad= feature that was implemented in version 3.6:

During an effort to ignore IKEv2 minor version numbers as required for RFC-5996, complete parse errors of any IKE packets with version 2.1+ were mistakenly accepted for further processing. This causes a crash later on if the IKE packet is mangled (e.g. too short). Openswan turns out not to be vulnerable because it happens to abort on the mismatched IKE length versus packet length before it inspects the rest of the IKE header. And since reading an invalid IKE major aborts further parsing of the IKE header, the length remains at 0, and so it will always mismatch.

As noted, this only affects upstream version 3.6 where the ike_pad= feature was added.  Current Fedora and EPEL ship libreswan 3.5.

Comment 1 Vincent Danen 2013-11-18 23:17:56 UTC
Code to fix:

https://github.com/libreswan/libreswan/commit/9b31deafbdbf0c2206358dfbf2d4e343e365f23f

Closing as this does not affect anything we ship.

Comment 2 Vincent Danen 2013-12-12 17:52:57 UTC
External Reference:

https://libreswan.org/security/CVE-2013-4564/CVE-2013-4564.txt.asc

Comment 3 Vincent Danen 2013-12-12 17:56:19 UTC
Also note that the upstream also explicitly notes:

While the vulnerable code is present in all libreswan versions, and
some openswan versions, only libreswan version 3.6 exposed this code to
malicious IKE packets due to its new IKE padding feature.


Note You need to log in before you can comment on or make changes to this bug.