From 33eadbfcc8d05df628963e098836672f7474a259 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Wed, 12 Mar 2014 11:05:44 +0100 Subject: [PATCH] ikev2: Reject CREATE_CHILD_SA exchange on unestablished IKE_SAs Prevents a responder peer to trick us into established state by starting IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH. Fixes CVE-2014-2338 for 4.2.x versions of strongSwan. --- src/charon/sa/task_manager.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/charon/sa/task_manager.c b/src/charon/sa/task_manager.c index b1c755a..ccbbb7e 100644 --- a/src/charon/sa/task_manager.c +++ b/src/charon/sa/task_manager.c @@ -707,6 +707,15 @@ static status_t process_request(private_task_manager_t *this, case CREATE_CHILD_SA: { /* FIXME: we should prevent this on mediation connections */ bool notify_found = FALSE, ts_found = FALSE; + + if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED || + this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING) + { + DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " + "unestablished IKE_SA, rejected"); + return FAILED; + } + iterator = message->get_payload_iterator(message); while (iterator->iterate(iterator, (void**)&payload)) { -- 1.8.1.2