CVE-2019-12312: libreswan NULL Pointer Dereference
Vulnerability summary
CVE-2019-12312 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in libreswan. EPSS estimates a 2.75% chance of exploitation in the next 30 days, higher than 86% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 24-05-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.75%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.75% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (iwantacve.cn)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.
- CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Affected systems
Debian1 product
- libreswan< 3.27-5
Libreswan1 product
- libreswan< 3.28
2 vendors · 2 products
References
6 links- libreswan.org/security/CVE-2019-12312/CVE-2019-12312.txtX Refsource CONFIRM
- libreswan.org/security/CVE-2019-12312/libreswan-3.27-CVE-2019-12312.patchX Refsource CONFIRM
