CVE-2024-20474: Cisco AnyConnect IKEv2 DoS Vulnerability

CVE-2024-20474 Overview

A vulnerability exists in the Internet Key Exchange version 2 (IKEv2) processing component of Cisco Secure Client Software that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability stems from an integer underflow condition in how the software processes IKEv2 packets, which can be exploited by sending specially crafted packets to an affected system.

This vulnerability is particularly concerning for organizations relying on Cisco Secure Client (formerly known as Cisco AnyConnect Secure Mobility Client for versions 4.10 and earlier) for secure remote access. A successful exploit causes the client software to crash, disrupting VPN connectivity and potentially leaving remote workers unable to access corporate resources.

Critical Impact

Remote attackers can crash Cisco Secure Client without authentication by sending malicious IKEv2 packets, disrupting VPN connectivity for enterprise users.

Affected Products

• Cisco AnyConnect Secure Mobility Client versions 4.9.x (4.9.00086 through 4.9.06037)
• Cisco Secure Client versions 4.10.x (4.10.00093 through 4.10.08029)
• Cisco Secure Client versions 5.0.x and 5.1.x (5.0.00238 through 5.1.3.62)

Discovery Timeline

• October 23, 2024 - CVE-2024-20474 published to NVD
• November 1, 2024 - Last updated in NVD database

Technical Details for CVE-2024-20474

Vulnerability Analysis

CVE-2024-20474 is an integer underflow vulnerability (CWE-191) that occurs during the processing of IKEv2 protocol packets within Cisco Secure Client Software. Integer underflow vulnerabilities occur when an arithmetic operation attempts to create a numeric value that falls below the minimum value that can be represented in the allocated storage space, typically wrapping around to an unexpectedly large positive number.

In this case, the flaw exists in the IKEv2 packet processing logic. When the software receives a malformed IKEv2 packet with specific field values designed to trigger the underflow condition, the resulting unexpected value causes improper memory operations that lead to a software crash. Since the attack can be performed remotely over the network without requiring any authentication or user interaction beyond having an active VPN session, it poses a significant availability risk.

The impact is limited to denial of service affecting client availability—the vulnerability does not allow for data exfiltration or code execution. However, repeated exploitation could prevent users from maintaining stable VPN connections, effectively denying remote access to corporate networks.

Root Cause

The root cause of this vulnerability is an integer underflow condition in the IKEv2 packet processing code. When specific arithmetic operations are performed on packet field values without proper bounds checking, the result can underflow below zero. In unsigned integer contexts, this causes the value to wrap around to a very large positive number, leading to incorrect memory allocation sizes or buffer accesses that crash the application.

Attack Vector

The attack is network-based and can be executed by an unauthenticated remote attacker. The attacker must be able to send crafted IKEv2 packets to a system running the vulnerable Cisco Secure Client software. While user interaction is required in the sense that the VPN client must be actively establishing or maintaining a connection, no authentication credentials are needed by the attacker.

The attack flow involves:

1. Identifying a target system running vulnerable Cisco Secure Client software
2. Crafting a malicious IKEv2 packet with field values designed to trigger the integer underflow
3. Sending the crafted packet to the target system
4. The vulnerable software processes the packet, triggers the underflow condition, and crashes

The vulnerability manifests during IKEv2 packet processing when specific field values cause arithmetic operations to underflow. Technical details regarding the specific packet structure and triggering conditions can be found in the Cisco Security Advisory.

Detection Methods for CVE-2024-20474

Indicators of Compromise

• Unexpected crashes or terminations of the Cisco Secure Client application
• Multiple VPN connection failures or disconnections in a short time period
• Unusual IKEv2 traffic patterns or malformed packet logs in network security appliances
• User reports of VPN client instability or inability to maintain connections

Detection Strategies

• Monitor for repeated Cisco Secure Client process crashes using endpoint detection and response (EDR) solutions
• Implement network intrusion detection rules to identify malformed or anomalous IKEv2 packets targeting client systems
• Configure logging on VPN concentrators and firewalls to capture IKEv2 negotiation failures
• Use SentinelOne Singularity to detect and alert on abnormal application terminations and crash patterns

Monitoring Recommendations

• Enable verbose logging in Cisco Secure Client to capture diagnostic information during crashes
• Correlate VPN client crash events across the enterprise to identify potential attack campaigns
• Monitor network traffic for unusual volumes of IKEv2 packets from unexpected sources
• Implement real-time alerting for multiple simultaneous client disconnections that may indicate active exploitation

How to Mitigate CVE-2024-20474

Immediate Actions Required

• Inventory all systems running Cisco Secure Client or Cisco AnyConnect Secure Mobility Client to identify vulnerable installations
• Prioritize patching for users with critical remote access requirements
• Review the Cisco Security Advisory for fixed software versions and upgrade guidance
• Consider network segmentation to limit exposure of VPN clients to untrusted network traffic where possible

Patch Information

Cisco has released security updates to address this vulnerability. Administrators should consult the Cisco Security Advisory (cisco-sa-csc-dos-XvPhM3bj) to identify the appropriate fixed software version for their deployment and follow Cisco's upgrade procedures.

Organizations should update to a non-vulnerable version of Cisco Secure Client as soon as possible. Given the network-based attack vector and lack of authentication requirements, unpatched systems remain at risk whenever they establish VPN connections over untrusted networks.

Workarounds

• While no specific workarounds are documented, organizations can implement defense-in-depth measures
• Ensure VPN client traffic flows through network security devices capable of inspecting IKEv2 packets
• Consider restricting VPN connectivity to known-trusted networks until patching is complete
• Deploy endpoint protection solutions like SentinelOne to detect and respond to application crashes

# Verify Cisco Secure Client version on endpoints
# Windows PowerShell
Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*Cisco Secure Client*" -or $_.Name -like "*AnyConnect*"} | Select-Object Name, Version

# macOS Terminal
pkgutil --pkg-info com.cisco.pkg.anyconnect.vpn 2>/dev/null || pkgutil --pkg-info com.cisco.secureclient.vpn