CVE-2024-2357 IKEv2 misconfiguration can cause libreswan to abort and restart
Attackers can cause repeated crashes and restarts in Libreswan by exploiting IKEv2 retransmit scenarios with specific PreSharedKey configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-2357?
CVE-2024-2357 is a medium-severity denial of service vulnerability in The Libreswan Project (www.libreswan.org) libreswan, published on 11 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. When such a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes leading to a Denial of Service.
Which versions are affected by CVE-2024-2357?
Linux distribution packages (23)
libreswan AlmaLinux:8 | All versions | 4.12-2.el8_9.2.alma.1 |
libreswan AlmaLinux:9 | All versions | 4.12-1.el9_3.1.alma.1 |
libreswan AlmaLinux:9 | All versions | 4.12-2.el9_4.alma.1 |
libreswan Red Hat:enterprise_linux:8::appstream | All versions | 0:4.12-2.el8_9.2 |
libreswan-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:4.12-2.el8_9.2 |
libreswan-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:4.12-2.el8_9.2 |
libreswan Red Hat:enterprise_linux:9::appstream | All versions | 0:4.12-1.el9_3.1 |
libreswan Red Hat:enterprise_linux:9::appstream | All versions | 0:4.12-2.el9_4 |
libreswan-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:4.12-1.el9_3.1 |
libreswan-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:4.12-2.el9_4 |
libreswan-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:4.12-1.el9_3.1 |
libreswan-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:4.12-2.el9_4 |
libreswan Red Hat:rhel_eus:8.6::appstream | All versions | 0:4.5-1.el8_6.2 |
libreswan-debuginfo Red Hat:rhel_eus:8.6::appstream | All versions | 0:4.5-1.el8_6.2 |
libreswan-debugsource Red Hat:rhel_eus:8.6::appstream | All versions | 0:4.5-1.el8_6.2 |
libreswan Red Hat:rhel_eus:8.8::appstream | All versions | 0:4.9-3.el8_8.1 |
libreswan-debuginfo Red Hat:rhel_eus:8.8::appstream | All versions | 0:4.9-3.el8_8.1 |
libreswan-debugsource Red Hat:rhel_eus:8.8::appstream | All versions | 0:4.9-3.el8_8.1 |
libreswan Red Hat:rhel_eus:9.2::appstream | All versions | 0:4.9-5.el9_2.1 |
libreswan-debuginfo Red Hat:rhel_eus:9.2::appstream | All versions | 0:4.9-5.el9_2.1 |
libreswan-debugsource Red Hat:rhel_eus:9.2::appstream | All versions | 0:4.9-5.el9_2.1 |
libreswan Rocky Linux:8 | All versions | 0:4.12-2.el8_9.2 |
libreswan Rocky Linux:9 | All versions | 0:4.12-2.el9_4 |
How do I fix CVE-2024-2357?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-2357 being exploited?
There is no known exploitation of CVE-2024-2357 in the wild and no public exploit code.
Sources
Also known as ALSA-2024:1998, ALSA-2024:2033, ALSA-2024:2565, AZL-35885, CLSA-2025-1764957598, DEBIAN-CVE-2024-2357 and 13 more.