CVE-2024-3652 is a medium-severity vulnerability identified in Libreswan version 3.22, specifically affecting the handling of IKEv1 VPN connections. Libreswan is an open-source implementation of IPsec used widely for secure VPN tunnels. The vulnerability occurs when IKEv1 connections are established without explicitly specifying the esp= configuration line. In such cases, if the peer requests the AES-GMAC algorithm for authentication, Libreswan's default proposal handler triggers an assertion failure. This failure causes the Libreswan process to abort unexpectedly and restart, disrupting VPN service availability. The root cause is linked to improper handling of default AH/ESP configurations in the IKEv1 negotiation phase. Notably, IKEv2 connections remain unaffected by this issue. The vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release), indicating that the software does not gracefully handle unexpected negotiation parameters, leading to a crash. The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and impact limited to availability. No patches or fixes have been publicly released at the time of disclosure, and no known exploits have been reported in the wild. This vulnerability primarily threatens the stability and reliability of VPN services relying on Libreswan IKEv1 configurations, potentially causing denial of service through repeated process restarts.

The primary impact of CVE-2024-3652 is on the availability of VPN services using Libreswan with IKEv1 configurations. Organizations relying on Libreswan 3.22 for secure IPsec tunnels may experience unexpected service interruptions due to the process abort and restart triggered by the vulnerability. This can lead to denial of service conditions, disrupting secure communications, remote access, and site-to-site VPN connectivity. Although confidentiality and integrity of data are not directly compromised, the loss of VPN availability can affect business operations, especially for organizations dependent on continuous secure network access. The vulnerability requires an attacker to initiate IKEv1 negotiations with a specially crafted proposal requesting AES-GMAC, which is feasible for network-level adversaries with some privileges. The lack of impact on IKEv2 reduces the overall risk for environments that have migrated to newer protocols. However, legacy systems and configurations still using IKEv1 are at risk. The absence of known exploits limits immediate widespread impact, but the vulnerability could be leveraged for targeted denial of service attacks against critical infrastructure, government networks, and enterprises using Libreswan-based VPNs.

To mitigate CVE-2024-3652, organizations should first audit their Libreswan deployments to identify usage of version 3.22 and reliance on IKEv1 with default AH/ESP configurations. Where possible, explicitly specify the esp= line in IKEv1 configurations to avoid triggering the default proposal handler that causes the crash. Transitioning VPN configurations from IKEv1 to IKEv2 is strongly recommended, as IKEv2 is not affected by this vulnerability and offers improved security and stability. Monitor Libreswan project communications for forthcoming patches or updates addressing this issue and apply them promptly once available. In the interim, consider implementing network-level controls to restrict or monitor IKEv1 negotiation attempts from untrusted sources to reduce exposure. Additionally, configure robust logging and alerting on Libreswan service restarts to detect potential exploitation attempts. For critical environments, deploying redundant VPN gateways or failover mechanisms can help maintain availability during potential disruptions. Avoid using AES-GMAC in IKEv1 proposals until a fix is released or the configuration is hardened.