Lucene search

K
prionPRIOn knowledge basePRION:CVE-2019-12312
HistoryMay 24, 2019 - 2:29 p.m.

Null pointer dereference

2019-05-2414:29:00
PRIOn knowledge base
www.prio-n.com
7

0.005 Low

EPSS

Percentile

75.4%

In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.

CPENameOperatorVersion
libreswanlt3.28