CVE-2021-41990: 
strongSwan vulnerability analysis and mitigation

The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow vulnerability (CVE-2021-41990) discovered by researchers at the NSA. The vulnerability affects all versions since 5.6.1 and was disclosed on October 18, 2021. The issue exists in the handling of RSASSA-PSS signatures with very large salt lengths, which can be triggered by an unrelated self-signed CA certificate sent by an initiator (StrongSwan Blog).

The vulnerability occurs when processing RSASSA-PSS signatures whose parameters define a very high salt length, triggering an integer overflow that can lead to a segmentation fault. The gmp plugin assigns the parsed salt length to a size_t len field of a chunk_t structure and uses that value to verify the signature structure. With a very high salt length (e.g. 2^64-1), this causes an integer overflow that bypasses the initial validation check. If the padding check is passed, it eventually leads to an attempt to use the overflowed length in a memcpy() call, resulting in a segmentation fault (StrongSwan Blog). The vulnerability has a CVSS v3.1 Base Score of 7.5 HIGH (NVD).

The vulnerability can lead to a denial of service condition through a segmentation fault when processing crafted certificates. While generating a signature that bypasses the padding check requires access to the private key that signed the certificate, the certificate does not need to be trusted. Remote code execution is not possible through this vulnerability (StrongSwan Blog, Debian Advisory).

The vulnerability was fixed in strongSwan version 5.9.4. For installations that cannot upgrade immediately, a mitigation is to disable the gmp plugin since only this plugin is affected. For older releases, the strongSwan project provides a patch that fixes the vulnerability and should apply with appropriate hunk offsets (StrongSwan Blog). Various Linux distributions have also released security updates including Debian (5.7.2-1+deb10u1 for buster and 5.9.1-1+deb11u1 for bullseye) (Debian Advisory) and Fedora (Fedora Advisory).