Technical impact
A double‑free memory error occurs when strongSwan parses or clones an EAP‑Identity that is syntactically empty but not NULL encoded. The bug causes duplicate identity objects to be freed twice when the duplicates are destroyed, which can be leveraged by an attacker to corrupt memory and potentially execute arbitrary code or cause the process to crash. The flaw is categorized as CWE‑415, meaning unsafe deallocation of heap memory.
Affected Systems
The vulnerability affects the StrongSwan VPN software, specifically versions earlier than 6.0.7 released by the strongSwan group. Any deployment using a pre‑6.0.7 build is susceptible to the double‑free attack via the EAP authentication pathway.
Risk and Exploitability
The CVSS score of 7.5 classifies this flaw as high severity. Although the EPSS score is not available, the absence of a KEV listing does not mitigate the risk; an adversary who can initiate an EAP authentication session may trigger the vulnerability remotely. The exploit path requires crafting an EAP identity with an empty but non‑NULL encoding, then sending it to the VPN server. Successful exploitation could lead to a denial‑of‑service or, in the worst case, arbitrary code execution on the server.
Debian DSA
Ubuntu USN