Attack Chain

1. An attacker sends a malicious IKE_AUTH request to a vulnerable strongSwan server.
2. The request contains an EAP-SIM/AKA payload crafted to trigger the vulnerability.
3. The simaka_message_create_from_payload() function processes the received data.
4. Inside parse_attributes() in simaka_message.c, the code calculates the attribute data length using hdr->length * 4 - 4.
5. If hdr->length is 0, the calculation results in an integer underflow, leading to a large value being used for the size of the data to be copied.
6. The code allocates a small chunk of memory using malloc(sizeof(attr_t) + data.len).
7. An oversized memcpy operation is performed, copying data beyond the allocated buffer, leading to a heap buffer overflow.
8. This overflow can lead to arbitrary code execution, potentially granting the attacker complete control of the system.

Impact

Successful exploitation of this vulnerability (CVE-2026-35330) allows a remote, unauthenticated attacker to achieve arbitrary code execution on a vulnerable strongSwan server. Given that strongSwan is frequently used to establish VPN connections, successful exploitation could grant an attacker unauthorized access to internal networks and sensitive data. The Exploit-DB entry confirms the exploit’s feasibility.

Recommendation

• Upgrade strongSwan to a version patched against CVE-2026-35330. The fix is available in master >= aa5aaebc33 as referenced in the Exploit-DB entry.
• Deploy the Sigma rule “Detect strongSwan libsimaka Heap Overflow Attempt” to identify potential exploitation attempts by monitoring for EAP-SIM/AKA messages with a zero-length attribute, as described in the vulnerability details.
• Apply input validation on EAP-SIM/AKA attribute lengths to prevent the integer underflow, addressing the root cause described in the exploit details.