CVE-2023-41913

Vulnerability

A buffer overflow vulnerability exists in strongSwan's charon-tkm IKE daemon, affecting versions since 5.3.0 and before 5.9.12. The flaw resides in the diffie_hellman_t::set_other_public_value() method (or key_exchange_t::set_public_key() in newer releases), which acts as a proxy for Diffie-Hellman operations between the IKE daemon and the Trusted Key Manager (TKM). A helper function added in version 5.3.0 removed direct validation of DH public values from the KE payload handling, making DH backends responsible for verification. However, charon-tkm's implementation was forgotten and contains an unchecked memcpy() that copies the received DH public value to a fixed 512-byte stack buffer without verifying its length. An attacker can send a specially crafted, unauthenticated IKE_SA_INIT message with a DH public value exceeding this buffer, causing a stack-based buffer overflow (CWE-121). [1][2]

Exploitation

An unauthenticated attacker with network access to a vulnerable strongSwan system can exploit this vulnerability by sending a crafted IKE_SA_INIT message containing an oversized Diffie-Hellman public value. The value's length is only limited by the maximum accepted IKE message size, which defaults to 10,000 bytes. The memcpy() in charon-tkm's proxy function copies this value into a 512-byte stack buffer without bounds checking, triggering a buffer overflow. No prior authentication or user interaction is required [2]. The attack vector is remote over the network protocol port used for IKE (typically UDP 500 or 4500). [2]

Impact

Successful exploitation could allow an unauthenticated remote attacker to achieve arbitrary code execution in the context of the charon-tkm process. This could lead to a full compromise of the affected system, disclosure of sensitive information, or denial of service. The heap-based buffer overflow may be leveraged to overwrite critical data and execute arbitrary code, although specific exploit details are not publicly disclosed. [2]

## Mitigation strongSwan fixed this vulnerability in version 5.9.12 and 6.0.0 (re-released as 6.0.6). Users should upgrade to at least strongSwan 5.9.12 (the last 5.9.x release) or 6.0.6, which includes the patch. No workaround has been published for systems that cannot upgrade. Users of the charon-tkm daemon should prioritize this update. The vulnerability is not currently listed on the CISA KEV catalog. [1][2]