CVE-2024-22052: Ivanti Connect Secure DoS Vulnerability

CVE-2024-22052 Overview

CVE-2024-22052 is a null pointer dereference vulnerability [CWE-476] in the IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure. An unauthenticated remote attacker can send specially crafted requests to crash the service, resulting in a denial-of-service (DoS) condition. The flaw requires no authentication, no user interaction, and is exploitable over the network, making exposed VPN gateways susceptible to disruption by any internet-based attacker.

Ivanti disclosed this issue alongside CVE-2024-21894, CVE-2024-22053, and CVE-2024-22023 in a coordinated April 2024 advisory.

Critical Impact
An unauthenticated attacker can remotely crash the IPSec service on Ivanti Connect Secure and Policy Secure gateways, disrupting VPN access for all users until the service recovers.

Affected Products

Ivanti Connect Secure 9.1 (releases R1 through R18) and 9.0
Ivanti Connect Secure 22.1, 22.2, 22.3, 22.4, 22.5, 22.6
Ivanti Policy Secure 9.0, 9.1 (releases R1 through R18) and 22.1 through 22.6

Discovery Timeline

2024-04-04 - CVE-2024-22052 published to NVD
2024-04-04 - Ivanti publishes coordinated security advisory covering CVE-2024-21894, CVE-2024-22052, CVE-2024-22053, and CVE-2024-22023
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-22052

Vulnerability Analysis

The vulnerability resides in the IPSec component used by Ivanti Connect Secure and Ivanti Policy Secure to terminate VPN tunnels. The component dereferences a pointer without first verifying that the pointer is non-null. When an attacker submits a crafted IPSec request that triggers the unchecked code path, the process attempts to read or write memory through the null pointer and the operating system terminates the service.

Because IPSec listens on the public-facing interface of these gateways, the attack surface is reachable from any host that can deliver IKE/IPSec traffic to the appliance. The vulnerability falls under improper check or handling of exceptional conditions [CWE-703] in addition to the null pointer dereference [CWE-476].

The issue produces an availability impact only. It does not expose data, modify configuration, or grant code execution. However, sustained exploitation prevents legitimate VPN users and policy enforcement clients from connecting, which can isolate remote workforces and break security policy distribution.

Root Cause

The IPSec service handler fails to validate that a required object or buffer pointer is initialized before dereferencing it during request parsing. Specific crafted input drives the code into a branch where the pointer is expected to be set but remains null, causing a segmentation fault that terminates the worker process.

Attack Vector

Exploitation requires only network reachability to the IPSec endpoint on the Ivanti gateway. The attacker sends one or more malformed IPSec protocol messages to the appliance. No credentials, session tokens, or prior reconnaissance are required. The crafted request triggers the null dereference and the service crashes. Repeated requests can keep the service unavailable. The EPSS score of 4.15% (88.77 percentile) reflects elevated exploitation interest relative to the broader CVE population.

No verified public proof-of-concept code was identified at the time of writing. See the Ivanti Security Advisory for vendor-supplied technical context.

Detection Methods for CVE-2024-22052

Indicators of Compromise

Unexpected restarts or crash log entries for the IPSec/IKE service (iked, ipsecd, or equivalent) on the Ivanti appliance
Repeated malformed IKE/IPSec packets from a single external source IP to UDP/500 or UDP/4500
Sudden drop in active VPN tunnels followed by VPN client reconnect storms
Gateway health alerts indicating service watchdog restarts within short time windows

Detection Strategies

Monitor appliance syslog and crash dumps for IPSec worker process termination signatures
Correlate VPN tunnel disconnect events with inbound IKE traffic anomalies from the same source
Deploy network IDS signatures for malformed IKE_SA_INIT and IKE_AUTH payloads targeting the gateway
Track the Ivanti Integrity Checker Tool (ICT) output for unexpected configuration or binary state changes

Monitoring Recommendations

Forward Ivanti Connect Secure and Policy Secure syslog data to a centralized SIEM for service-state correlation
Alert on sustained UDP/500 or UDP/4500 traffic volume spikes from non-customer IP ranges
Baseline normal IPSec service uptime and trigger detections on repeated short-interval restarts

How to Mitigate CVE-2024-22052

Immediate Actions Required

Apply the patched releases supplied by Ivanti for Connect Secure and Policy Secure as documented in the vendor advisory
Inventory all internet-exposed Ivanti gateways and confirm running version against the fixed releases
Restrict IKE/IPSec traffic to known partner and client IP ranges where business requirements allow
Run the Ivanti Integrity Checker Tool (ICT) after patching to validate appliance state

Patch Information

Ivanti released fixed builds for Connect Secure 9.1Rx and 22.x branches and for Policy Secure 9.x and 22.x branches as part of the April 2024 coordinated advisory. Refer to the Ivanti Security Advisory for the exact target builds for each release train and download links.

Workarounds

Place the Ivanti gateway behind upstream firewall or DDoS scrubbing services that can rate-limit and filter malformed IKE traffic
Apply source IP allow-lists at the perimeter for UDP/500 and UDP/4500 to reduce exposure until patching completes
Enable high-availability pairing so that a failed IPSec service on one node fails over while the affected node restarts
Increase monitoring frequency on the IPSec service and configure automated restart with alerting if vendor patching is delayed

bash

# Example perimeter ACL restricting IPSec to known client ranges
# Replace 198.51.100.0/24 with authorized client CIDR blocks
iptables -A FORWARD -p udp --dport 500  -s 198.51.100.0/24 -d <ivanti_gw_ip> -j ACCEPT
iptables -A FORWARD -p udp --dport 4500 -s 198.51.100.0/24 -d <ivanti_gw_ip> -j ACCEPT
iptables -A FORWARD -p udp --dport 500  -d <ivanti_gw_ip> -j DROP
iptables -A FORWARD -p udp --dport 4500 -d <ivanti_gw_ip> -j DROP