IKEv2 Malformed Notify Payload Buffer Corruption in 'iked' Daemon
A classic buffer copy overflow [CWE-120] in the FortiOS Internet Key Exchange daemon (/bin/iked) allows remote unauthenticated actors sending crafted IKEv2 Notify payloads on UDP 500/4500 to corrupt daemon heap memory and crash the IPsec subsystem.
Technical Root Cause Analysis
The FortiOS IPsec management daemon (/bin/iked) listens for phase-1 security association handshakes over UDP ports 500 (standard IKE) and 4500 (NAT-Traversal). The IKEv2 protocol uses Notify Payloads (payload type 41) to exchange status codes, error notifications, and vendor-specific protocol negotiation parameters.
When handling unauthenticated IKE_SA_INIT or early IKE_AUTH packets, the function ike2_parse_notify_payload extracts the SPI size, Notify Message Type, and arbitrary notification data bytes. The daemon allocates a fixed-size internal memory buffer but relies on the user-supplied 16-bit payload length header to execute the memory copy without verifying that the payload size fits within allocated bounds.
Sending a crafted Notify payload containing oversized notification data overflows the stack and heap memory structures within iked. This causes an immediate segmentation fault (signal 11), collapsing all established IPsec Phase 1 and Phase 2 security associations and severing site-to-site connectivity across the enterprise.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.1 – 7.2.4 | 7.2.5+ | Apply local-in filter on UDP 500/4500 |
| FortiOS 7.0 | 7.0.6 – 7.0.11 | 7.0.12+ | Apply local-in filter; upgrade firmware |
| FortiOS 7.4 | Not Affected | 7.4.0+ Clean | Safe bounded packet parser |
| FortiOS 6.4 | Not Affected | 6.4.x Clean | Legacy packet parsing routine |
Platform Impact: Affects all FortiGate appliances running IPsec IKEv2 with public interfaces listening on UDP ports 500 and 4500. Dynamic dialup gateways accepting connections from any remote IP are especially vulnerable.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands via SSH or console to audit the IKE daemon status, inspect crashlogs for iked terminations, and evaluate active gateway health:
Diagnostic Commands
# 1. Audit IKE daemon operational status, memory, and active Phase 1 SA counts
diagnose vpn ike status
# 2. Inspect kernel crashlog for iked segfaults or abnormal daemon restarts
diagnose debug crashlog read | grep iked
# 3. Query all configured and established IKE Phase 1 gateways
diagnose vpn ike gateway listRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
Oversized notification data bytes within IKEv2 Notify payloads (Payload 41) exceed allocated buffer boundaries in ike2_parse_notify_payload, overflowing stack and heap structures.
NP7 offloaded sessions continue briefly, but as soon as Phase 2 SAs require rekeying or DPD probes fail, hardware flow entries are invalidated and traffic drops completely.
FortiOS 7.2.5, 7.0.12, and all releases of FortiOS 7.4.x and 7.6.x permanently resolve this vulnerability with strict length bounds checking.