Description

In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T03:16:47.490Z",
  "pubdate": "2026-09-02T03:16:47.490Z",
  "executiveSummary": "A denial of service (DoS) vulnerability exists in the Libreswan pluto daemon when operating in FIPS mode. The issue stems from an improper assertion handling within the add_decoded_cert() function, which fails to gracefully manage null pointers returned by CERT_ExtractPublicKey().\nAn unauthenticated remote attacker can exploit this by sending a specially crafted X.509 certificate within a CERT payload during the IKEv1 or IKEv2 handshake process. Successful exploitation triggers an assertion failure, causing the pluto daemon to terminate immediately, leading to a service outage.\nThe vulnerability is restricted to environments where both the host operating system and Libreswan are configured for FIPS mode, and at least one CA certificate is present in the NSS database. Systems using exclusively PreSharedKey (PSK) authentication without CA certificates are not impacted. As the vulnerability is triggered during the pre-authentication phase, no valid credentials are required to initiate the attack. The flaw presents a significant risk to network availability in high-security environments, though it does not allow for remote code execution or unauthorized system access.",
  "technicalDetails": "The vulnerability resides within the add_decoded_cert() function of the Libreswan pluto daemon. In FIPS-compliant environments, the implementation relies on the NSS library's CERT_ExtractPublicKey() function to retrieve public key information from incoming X.509 certificates.\nThe root cause is a logic error involving an over-reliance on a defensive assertion. The source code explicitly asserts that the return value of CERT_ExtractPublicKey() will never be NULL. However, the NSS library may return a NULL pointer if the public key extraction process fails—for instance, when encountering an RSA exponent of 0 or other malformed cryptographic parameters within the certificate structure.\nThe attack flow begins with the attacker initiating an IKEv1 or IKEv2 exchange. The attacker provides a malicious X.509 certificate encapsulated within a CERT payload. Because the pluto daemon processes the CERT payload prior to peer authentication, the malicious certificate is parsed immediately upon receipt.\nWhen add_decoded_cert() attempts to extract the public key, the underlying NSS library fails due to the malformed input. Because the code does not implement error handling for a NULL return value and instead triggers an assertion, the process encounters an abort signal. This results in the immediate, non-recoverable termination of the pluto daemon.\nThis behavior facilitates a remote denial of service. By repeatedly sending the malformed certificate, an attacker can continuously crash the pluto daemon, preventing the establishment of VPN tunnels and disrupting network connectivity for all users reliant on the service. The vulnerability is explicitly gated by the FIPS-mode configuration, which likely alters the certificate validation paths or dependencies, and requires at least one CA certificate to be loaded in the NSS database to trigger the vulnerable code path.\nSince the vulnerability is triggered before the authentication exchange is finalized, the attacker maintains total anonymity and does not require pre-existing system privileges. No memory corruption or control-flow hijacking occurs; the impact is strictly limited to an availability degradation via a forced process termination."
}