CVE-2018-10811

Vulnerability

A denial-of-service vulnerability exists in strongSwan versions 5.0.1 and later (up to and including 5.6.0) when the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as the PRF. The variable storing the SKEYSEED for IKEv2 key derivation is not initialized before being used. If the PRF's set_key() or allocate_bytes() functions fail, an attempt to clear the uninitialized memory via chunk_clear() results in a crash. [1]

Exploitation

An attacker with network access to an IKEv2 responder that meets the configuration criteria (openssl plugin in FIPS mode, HMAC-MD5 as PRF) can trigger the vulnerability by sending a crafted IKEv2 message that causes the PRF operations to fail. No authentication is required. The attacker does not need any special privileges. The exact steps involve initiating an IKEv2 exchange that leads to key derivation where the negotiated PRF is HMAC-MD5 and the openssl plugin's FIPS mode is active. [1]

Impact

Successful exploitation causes the strongSwan daemon (charon) to crash, resulting in a denial of service. The impact is limited to availability; no information disclosure or privilege escalation occurs. The crash terminates existing IPsec tunnels and prevents new ones from being established until the service is restarted. [1][2]

Mitigation

The vulnerability is fixed in strongSwan version 5.7.1 and later. Users should upgrade to at least this version. If upgrading is not possible, a workaround is to avoid using the openssl plugin in FIPS mode with HMAC-MD5 as the PRF, or to disable the use of HMAC-MD5 altogether. Ubuntu users can apply the updates provided in USN-3771-1. Gentoo users should upgrade to net-vpn/strongswan-5.7.1 or later. [1][2][4]