title: IKEv2 misconfiguration can cause libreswan to abort and restart
description: The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. When such a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes leading to a Denial of Service.
problem types: IKEv2 misconfiguration can cause libreswan to abort and restart
affected:
{
vendor: The Libreswan Project (www.libreswan.org)
product: libreswan
versions:
version: 3.0, status: unaffected, lessThanOrEqual: 4.1, versionType: semver
version: 4.2, status: affected, lessThanOrEqual: 4.12, versionType: semver
version: 5.0, status: unaffected
defaultStatus: unaffected
}
solutions: This issue is fixed in 4.13, 5.0 and all later versions.
workarounds: As a workaround, one can place an unguessable long random default secret in /etc/ipsec.secrets, for example using the following command:
echo -e "# CVE-2024-2357 workaround
: PSK "$(openssl rand -hex 32)"" >> /etc/ipsec.secrets
This will ensure a PSK secret is always found, but it will always be wrong, and thus authentication will still properly fail.