CVE-2021-41991: strongSwan Certificate Cache RCE Flaw

CVE-2021-41991 Overview

CVE-2021-41991 is an integer overflow vulnerability in the in-memory certificate cache of strongSwan, an open-source IPsec-based VPN solution. The vulnerability exists in versions prior to 5.9.4 and can be triggered remotely by sending many requests with different certificates to fill the cache, subsequently triggering the replacement of cache entries. The code attempts to select a less-often-used cache entry using a random number generator, but this mechanism is not implemented correctly, leading to the integer overflow condition. While the primary impact is denial of service, remote code execution is considered a slight possibility.

Critical Impact

Remote attackers can trigger an integer overflow in strongSwan's certificate cache, potentially causing denial of service across VPN infrastructure and industrial control systems. This affects numerous Siemens industrial products using strongSwan for secure communications.

Affected Products

• strongSwan versions prior to 5.9.4
• Debian Linux versions 9.0, 10.0, and 11.0
• Fedora versions 33, 34, and 35
• Siemens SINEMA Remote Connect Server
• Siemens SCALANCE SC-600 family devices (SC622-2C, SC632-2C, SC636-2C, SC642-2C, SC646-2C)
• Siemens SIMATIC CP series (CP 1243-1, CP 1242-7 GPRS V2, CP 1543-1, CP 1543SP-1, CP 1542SP-1)
• Siemens SIPLUS S7-1200 CP 1243-1 series
• Siemens SIPLUS ET 200SP CP series

Discovery Timeline

• October 18, 2021 - CVE-2021-41991 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-41991

Vulnerability Analysis

The vulnerability resides in strongSwan's in-memory certificate cache mechanism, which is designed to store and manage X.509 certificates for IKE (Internet Key Exchange) authentication during IPsec VPN negotiations. When the cache reaches capacity and needs to replace entries, the code attempts to identify less frequently used cache entries for eviction using a random number generator. However, the implementation contains a flaw in the integer arithmetic used during this selection process.

When an attacker sends a large number of authentication requests using different certificates, the cache fills up and triggers the replacement logic. The integer overflow occurs during the calculation related to cache entry selection, which can corrupt memory management and lead to unexpected behavior. The attack is classified under CWE-190 (Integer Overflow or Wraparound), reflecting the core issue of improper handling of integer boundaries.

This vulnerability is particularly concerning for industrial environments, as evidenced by the extensive list of affected Siemens industrial control products that incorporate strongSwan for secure VPN communications. Compromise of these systems could impact operational technology (OT) networks.

Root Cause

The root cause is improper integer handling in the certificate cache eviction algorithm. When calculating which cache entry to replace, the code performs arithmetic operations that can overflow when processing a large number of certificate requests. The random number generator used to select less-frequently-used entries does not properly account for integer boundary conditions, causing the overflow to manifest when the cache is under heavy load from diverse certificate submissions.

Attack Vector

The attack can be executed remotely over the network without requiring authentication. An attacker sends numerous IKE authentication requests, each containing a different certificate, to a strongSwan server. This process fills the certificate cache to capacity. Once the cache is full, subsequent certificate submissions trigger the cache replacement algorithm where the integer overflow occurs.

The attack flow involves:

1. Attacker establishes multiple IKE sessions with the target strongSwan server
2. Each session presents a unique certificate for authentication
3. The certificate cache fills and initiates entry replacement
4. The flawed random selection algorithm triggers an integer overflow
5. The overflow leads to denial of service, with a slight possibility of remote code execution

Detection Methods for CVE-2021-41991

Indicators of Compromise

• Unusual spikes in IKE authentication requests from single or distributed sources
• High volume of certificate validation failures in strongSwan logs
• Service crashes or restarts of the strongSwan daemon (charon or starter)
• Memory corruption symptoms in IKE daemon processes
• Abnormal resource consumption by strongSwan-related processes

Detection Strategies

• Monitor strongSwan logs for excessive certificate processing events and authentication anomalies
• Implement network-based detection for abnormally high volumes of IKE_SA_INIT or IKE_AUTH exchanges
• Deploy intrusion detection signatures targeting rapid certificate submission patterns
• Configure system monitoring to detect unexpected strongSwan daemon restarts or crashes
• Use memory integrity monitoring tools to detect heap corruption in IKE processes

Monitoring Recommendations

• Enable detailed logging in strongSwan configuration to capture certificate cache operations
• Implement centralized log collection for strongSwan instances to correlate attack patterns across infrastructure
• Set up alerting thresholds for IKE authentication failures and certificate processing rates
• Monitor Siemens industrial devices running affected firmware for connectivity disruptions
• Review IKE traffic patterns at network boundaries for signs of cache-flooding attacks

How to Mitigate CVE-2021-41991

Immediate Actions Required

• Upgrade strongSwan to version 5.9.4 or later immediately
• Apply security updates from Debian (DSA-4989) and Fedora for affected distributions
• Review and apply Siemens firmware updates for affected SCALANCE, SIMATIC, and SIPLUS devices as per SSA-539476
• Implement network segmentation to limit exposure of VPN endpoints to untrusted networks
• Enable rate limiting for IKE authentication requests where possible

Patch Information

The vulnerability is fixed in strongSwan version 5.9.4. The patch addresses the integer overflow in the certificate cache replacement algorithm by implementing proper bounds checking. Organizations should apply the following updates based on their environment:

• strongSwan: Upgrade to version 5.9.4 or later via the official GitHub release
• Debian: Apply updates as described in DSA-4989 and the Debian LTS announcement
• Fedora: Apply package updates announced via Fedora mailing lists for versions 33, 34, and 35
• Siemens Products: Follow guidance in the Siemens Security Advisory SSA-539476 for firmware updates

Workarounds

• Restrict network access to strongSwan VPN endpoints using firewall rules to limit exposure to trusted IP ranges
• Implement connection rate limiting at the network perimeter to slow down cache-flooding attempts
• Consider deploying additional authentication mechanisms before IKE establishment where architecturally feasible
• For Siemens industrial products, isolate affected devices in segmented network zones until firmware updates can be applied
• Monitor affected systems closely with enhanced logging until patches are deployed

# Verify strongSwan version after patching
ipsec version

# Example: Restrict IKE traffic to trusted networks using iptables
iptables -A INPUT -p udp --dport 500 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j DROP
iptables -A INPUT -p udp --dport 4500 -j DROP