CVE-2021-45079: 
strongSwan vulnerability analysis and mitigation

A vulnerability (CVE-2021-45079) was discovered in strongSwan versions from 4.1.2 up to (excluding) 5.9.5. The vulnerability, discovered by Zhuowei Zhang, affects the EAP authentication client implementation where a malicious responder can send an EAP-Success message too early without actually authenticating the client and, in some cases, without server authentication (StrongSwan Blog). The vulnerability was disclosed on January 24, 2022, and received a CVSS v3.1 base score of 9.1 (Critical) (NVD).

The vulnerability stems from incorrect handling of early EAP-Success messages in the EAP authentication client code. When receiving an EAP-Success message, the client code incorrectly assumed that an instance of an EAP method would exist and unconditionally called the get_msk() method to retrieve any Master Session Key (MSK). This could lead to a NULL-pointer dereference causing a crash. For non-key-generating EAP methods, the code ignored negative results from the get_msk() call, generating AUTH payloads without MSK even for methods that should be key-generating but were never completed (StrongSwan Blog).

The vulnerability could result in multiple severe impacts: a denial of service through daemon crashes, bypass of client authentication, and in scenarios using EAP-only authentication, potential bypass of both client and server authentication. In cases where authentication is bypassed, attackers could potentially read unencrypted traffic sent through the VPN tunnel or access hosts behind the client if local traffic selectors included subnets (StrongSwan Blog).

The vulnerability was fixed in strongSwan version 5.9.5. Systems not using EAP authentication are not vulnerable. Configurations that don't use EAP-only authentication and require VPN server authentication with a certificate first (such as the Android client and NetworkManager plugin) are also protected, unless using mutual EAP method where AAA server identity/authentication is important. For older releases, patches are available for versions 5.0.1 and newer (StrongSwan Blog).