CVE-2023-2295
High · 7.5CVSS
7.5
EPSS
1.6%
Published
May 17, 2023
CISA due date
—
Cloudanix analysis
A bug in VPN software can make it stop working when it receives certain network messages, cutting off secure connections until the system is restarted or fixed.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- Library
- Class
- Denial of service
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The pluto daemon in libreswan crashes on receipt of an IKEv1 Aggressive Mode packet containing only unacceptable crypto algorithms when the response omits a zero responder SPI; a follow-up packet that reuses the libreswan responder SPI as its own initiator SPI triggers the state-machine fault, resulting in denial of service.
Why it matters to the business
Disruption of IPsec VPN tunnels on affected systems can interrupt site-to-site or remote-access connectivity, causing operational downtime for organizations that rely on libreswan or Red Hat Enterprise Linux VPN services.
How an attack unfolds
An unauthenticated remote attacker sends a crafted IKEv1 Aggressive Mode packet with unacceptable transforms, receives a response that does not clear the responder SPI, then transmits a second packet reusing that SPI value to force the libreswan state machine into an invalid state and crash the daemon.
How to fix it
Apply the latest libreswan package updates or Red Hat Enterprise Linux errata that resolve the CVE-2023-30570 regression for RHEL 8.8 and 9.2; disable IKEv1 Aggressive Mode if not required until patches can be deployed.
How to confirm the fix worked
Confirm the installed libreswan version contains the fix, review pluto daemon logs for absence of the crash signature, and perform functional IKEv1 Aggressive Mode tests in a lab environment to verify continued operation.
Typical attack path
- Send IKEv1 Aggressive Mode packet containing only unacceptable crypto algorithms
- Observe response packet that does not include a zero responder SPI
- Transmit subsequent IKE packet reusing the responder SPI as initiator SPI
- Trigger pluto daemon crash and VPN service termination
How to detect it
Search pluto and system logs for daemon crashes or segmentation faults immediately following IKEv1 Aggressive Mode exchanges; inspect network captures for repeated IKE packets that reuse SPI values after an initial unacceptable-algorithm offer.
What your security team should do
- Prioritize patching of internet-facing and critical VPN gateways running affected libreswan or RHEL releases
- Review firewall rules to restrict IKE traffic to trusted peers where feasible
- Enable logging of pluto daemon crashes and monitor for repeated IKE negotiation failures
- Plan rollback or alternative VPN solutions if immediate patching is delayed
The record
A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | libreswan | 0 | 4.9-3.el8_8 |
| AlmaLinux:9 | libreswan | 0 | 4.9-4.el9_2 |
| Red Hat:enterprise_linux:8::appstream | libreswan | 0 | 0:4.9-3.el8_8 |
| Red Hat:enterprise_linux:8::appstream | libreswan-debuginfo | 0 | 0:4.9-3.el8_8 |
| Red Hat:enterprise_linux:8::appstream | libreswan-debugsource | 0 | 0:4.9-3.el8_8 |
| Red Hat:enterprise_linux:9::appstream | libreswan | 0 | 0:4.9-4.el9_2 |
| Red Hat:enterprise_linux:9::appstream | libreswan-debuginfo | 0 | 0:4.9-4.el9_2 |
| Red Hat:enterprise_linux:9::appstream | libreswan-debugsource | 0 | 0:4.9-4.el9_2 |
| Red Hat:openshift:4.15::el9 | libreswan | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.15::el9 | libreswan-debuginfo | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.15::el9 | libreswan-debugsource | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.16::el9 | libreswan | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.16::el9 | libreswan-debuginfo | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.16::el9 | libreswan-debugsource | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.17::el9 | libreswan | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.17::el9 | libreswan-debuginfo | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:openshift:4.17::el9 | libreswan-debugsource | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:rhel_e4s:9.0::appstream | libreswan | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:rhel_e4s:9.0::appstream | libreswan-debuginfo | 0 | 0:4.6-3.el9_0.3 |
| Red Hat:rhel_e4s:9.0::appstream | libreswan-debugsource | 0 | 0:4.6-3.el9_0.3 |
| Rocky Linux:8 | libreswan | 0 | 0:4.9-3.el8_8 |
| Ubuntu:18.04:LTS | libreswan | 0 | No fix |
| Ubuntu:20.04:LTS | libreswan | 0 | No fix |
| Ubuntu:22.04:LTS | libreswan | 0 | No fix |
| Ubuntu:24.04:LTS | libreswan | 0 | No fix |
| Ubuntu:24.10 | libreswan | 0 | No fix |
| Ubuntu:25.04 | libreswan | 0 | No fix |
| Ubuntu:25.10 | libreswan | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | libreswan | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | libreswan | 0 | No fix |