strongSwan versions up to 5.9.13 contain a pre-authentication heap buffer overflow in the libsimaka library. The bug lives in parse_attributes() inside simaka_message.c, and it’s bad enough that an attacker can trigger it before any peer authentication happens during IKE_AUTH.
Here’s the mechanics: the function computes attribute data length as hdr->length * 4 - 4 without checking whether the length field is zero. When it is zero, the validation check passes because 0 > in.len evaluates false on any non-empty input. The chunk length then wraps around to an enormous value, leading to a tiny allocation followed by a massive memcpy. On AddressSanitizer builds you get a clean heap-buffer-overflow detection. On production glibc systems, it’s an immediate crash when memcpy walks into unmapped memory.
The exploit is also straightforward to run — compile a small binary against the vulnerable library, point it at a strongSwan instance with eap-sim or eap-aka built and enabled, and watch it blow up. No credentials needed. No handshake completion required.
If you’re running strongSwan with any EAP-SIM/AKA plugins enabled, upgrade immediately. The fix is in the upstream commit aa5aaebc33. As a workaround, disabling the affected plugins removes the attack surface entirely.
