CVE-2020-27638
📋 TL;DR
This vulnerability in fastd (a VPN daemon) allows denial of service through an assertion failure when receiving packets with invalid type codes. Attackers can crash fastd instances by sending specially crafted packets. Systems running fastd versions before v21 are affected.
💻 Affected Systems
- fastd
📦 What is this software?
Fastd by Fastd Project
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of VPN connectivity, potentially affecting all traffic routed through fastd.
Likely Case
Service crash requiring manual restart, causing temporary VPN connectivity loss.
If Mitigated
Minimal impact if fastd is behind firewalls or not internet-facing.
🎯 Exploit Status
Simple packet crafting required. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v21
Vendor Advisory: https://fastd.readthedocs.io/en/stable/releases/v21.html
Restart Required: Yes
Instructions:
1. Stop fastd service. 2. Update to fastd v21 or later via package manager. 3. Restart fastd service.
🔧 Temporary Workarounds
Network filtering
linuxBlock or filter packets to fastd from untrusted sources
iptables -A INPUT -p udp --dport [fastd_port] -s ! [trusted_networks] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can send packets to fastd
- Monitor fastd process health and implement automatic restart mechanisms
🔍 How to Verify
Check if Vulnerable:
Check fastd version with 'fastd --version' and verify it's older than v21Check Version:
fastd --versionVerify Fix Applied:
Confirm version is v21 or newer with 'fastd --version'📡 Detection & Monitoring
Log Indicators:
- fastd crash logs
- assertion failure messages in system logs
Network Indicators:
- Unexpected packets to fastd port with invalid type codes
SIEM Query:
process:fastd AND (event:crash OR log_message:"assertion failure")🔗 References
- https://bugs.debian.org/972521
- https://fastd.readthedocs.io/en/stable/releases/v21.html
- https://github.com/NeoRaider/fastd/commit/737925113363b6130879729cdff9ccc46c33eaea
- https://lists.debian.org/debian-lts-announce/2020/10/msg00025.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2LNSF2LI4RQ7BVGHTJQUJWP7RVGHDTK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUZ3AGTAXH7OOP45F5WXBVRQ3IDWUR7M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSMH65GHKHMJAK2VMPROIPIUS4IA63CW/
- https://bugs.debian.org/972521
- https://fastd.readthedocs.io/en/stable/releases/v21.html
- https://github.com/NeoRaider/fastd/commit/737925113363b6130879729cdff9ccc46c33eaea
- https://lists.debian.org/debian-lts-announce/2020/10/msg00025.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2LNSF2LI4RQ7BVGHTJQUJWP7RVGHDTK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUZ3AGTAXH7OOP45F5WXBVRQ3IDWUR7M/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSMH65GHKHMJAK2VMPROIPIUS4IA63CW/
