CVE-2023-38710
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
An issue was discovered in Libreswan before version 4.12 related to IKEv2 Child SA REKEY packets containing an invalid IPsec protocol ID of 0 or 1. This results in an error notify INVALID_SPI being sent back, causing the pluto daemon to crash.
Risk Assessment
The crash of the pluto daemon may lead to service interruptions for VPN, affecting the availability and security of communication within the organization.
Recommendation
It is recommended to update Libreswan to version 4.12 or later to mitigate this vulnerability and prevent crashes.
Original NVD description (English source)
An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20.