A critical integer underflow vulnerability in strongSwan allows unauthenticated remote attackers to crash the IKE daemon, resulting in a denial of service.

The vulnerability exists within the eap-ttls plugin, where insufficient validation of the length field in attribute-value pairs (AVPs) leads to an integer underflow. This flaw allows an unauthenticated remote attacker to trigger a NULL pointer dereference or excessive memory allocation, causing the charon IKE daemon to crash.

Successful exploitation of this vulnerability results in a denial of service for the VPN gateway, rendering the secure tunnel inaccessible to all users. Given that strongSwan is widely deployed for enterprise and infrastructure connectivity, a service outage can cause significant operational disruption. With a CVSS score of 7.5, this high-severity flaw poses a clear risk to business continuity and availability of remote access services.

Immediate Action: Update strongSwan to version 6.0.5 or apply the official security patch provided by the vendor to resolve the integer underflow.

Proactive Monitoring: Monitor the charon daemon logs for recurring segmentation faults, unexpected service restarts, or high memory usage patterns associated with EAP-TTLS authentication attempts.

Compensating Controls: If patching is not immediately feasible, disable EAP-TTLS authentication or restrict access to the VPN gateway to trusted IP ranges to limit the exposure of the vulnerable endpoint.

Public Exploit Available: Yes — a non-destructive detection tool and technical write-up exist, as cited in the research documentation from the vulnerability finder.

The severity of this vulnerability, combined with the ease of triggering a denial of service, necessitates prompt attention. IT administrators should prioritize the deployment of strongSwan version 6.0.5 across all affected VPN gateways. If immediate updates cannot be performed, ensure that EAP-TTLS is not in use or implement strict network-level access controls to mitigate the risk of unauthenticated exploitation.