CVE-2026-77207 in Libreswan
Summary
by MITRE • 10/14/2026
Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Libreswan represents a critical failure in input validation within the Internet Key Exchange (IKE) certificate authentication mechanism, specifically affecting the handling of PKCS#7 wrapped X509 certificates. This flaw arises from an inconsistency between two Network Security Services NSS API functions used to validate incoming IKE CERT payloads. When Libreswan processes a packet with the payload type CERT_PKCS7_WRAPPED_X509, it employs SEC_PKCS7ContainsCertsOrCrls as a preliminary guard to determine if the PKCS#7 blob contains either certificates or Certificate Revocation Lists. This function correctly identifies that the structure is valid because it contains at least one CRL, returning true and allowing execution to proceed. However, the subsequent step involves calling SEC_PKCS7GetCertificateList to retrieve the actual certificate objects for verification. In scenarios where the PKCS#7 SignedData object includes a CRL but explicitly lacks any embedded certificates, this second function returns NULL rather than an empty list or a valid pointer structure.
This discrepancy creates a classic null pointer dereference condition within the Libreswan codebase. Because the initial guard passed based on the presence of the CRL, the application assumes that certificate data is available and attempts to iterate over it using the result from SEC_PKCS7GetCertificateList. Since this function returned NULL due to the absence of certificates, any subsequent operation attempting to access members or methods of this pointer results in a segmentation fault. This memory corruption event causes the Libreswan daemon process to crash immediately, triggering an automatic restart mechanism designed for service resilience but inadvertently facilitating repeated exploitation attempts. The technical root cause is classified under CWE-476, which denotes NULL Pointer Dereference, highlighting a failure to properly validate object references before use after conditional checks that do not guarantee the presence of all expected data structures.
From an operational perspective, this vulnerability poses a significant risk to network availability and integrity. An attacker can craft a malicious IKE_AUTH packet containing a specifically constructed PKCS#7 blob with a CRL but no certificates to trigger the crash remotely. Crucially, because this attack vector targets the authentication phase before peer identity is fully established or verified, it does not require prior successful authentication of the attacking party. This characteristic classifies the vulnerability as an unauthenticated remote denial-of-service threat. While the immediate impact is limited to service disruption through process termination and restart cycles, there are no indications that this specific flaw allows for arbitrary code execution or privilege escalation on the host system. The primary consequence remains a sustained ability to disrupt IKE connectivity by repeatedly crashing the daemon, thereby preventing legitimate users from establishing secure tunnels until the service is manually stabilized or patched.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The most effective solution is to apply vendor-provided patches that address this specific logic error in Libreswan releases where it has been identified. Administrators unable to patch immediately may consider implementing network-level access control lists to restrict IKE traffic sources to known, trusted IP addresses, thereby limiting the attack surface for unauthenticated packets. Furthermore, developers and maintainers should enforce stricter validation protocols by ensuring that SEC_PKCS7GetCertificateList results are explicitly checked against NULL before any iteration or dereferencing occurs. This aligns with secure coding practices recommended in industry standards such as CWE-20, which emphasizes proper input validation to prevent processing of malformed data structures. Additionally, monitoring for repeated IKE_AUTH failures and daemon restarts can serve as an early detection mechanism for ongoing exploitation attempts targeting this vulnerability.