# CVE-2022-21849 — Windows IKEv2 Extension `ikeext.dll` Stack Buffer Overflow

---

## Summary

| **Product** | Microsoft Windows — `ikeext.dll` (IKE and AuthIP IPsec Keying Modules) |
|---|---|
| **Vendor** | Microsoft Corporation |
| **Severity** | CVSS v3.1 **9.8 (Critical)** |
| **CVE Title** | Windows IKE Extension Remote Code Execution Vulnerability |
| **CWE** | CWE-121 (Stack-based Buffer Overflow) |
| **Affected Versions** | Windows 10/11 and Server with IPsec/IKEv2 enabled |
| **Impact** | Remote — unauthenticated attacker sends crafted VendorID payload → RCE |
| **Exploited ITW** | No |
| **Patch Date** | January 2022 Patch Tuesday |
| **Public analysis** | [78 Research Lab — IKEv2 VendorID stack overflow](https://blog.78researchlab.com/53e53729-d728-4635-a58d-08ad8a1f68e4) |

---

## Root Cause

During IKEv2 negotiation, peers exchange **Vendor ID payloads** to advertise
supported extensions. `ikeext!IkeLookupVendorId` handles vendorID `0x1000`,
which corresponds to **"MSFT IPsec Security Realm Id"**:

1. **`IkeLookupVendorId`** reads the vendorID payload length and allocates
   `v11 - 16` bytes for the data (subtracting the vendorID header overhead).

2. The code then calls **`IkeHandleSecurityRealmVendorId`** which invokes
   **`WfpBytesToString`** to convert the raw bytes to a string.

3. `WfpBytesToString` copies the data into a **fixed 80-byte stack buffer
   `v35`** without checking the input length — **stack buffer overflow**.

A vendorID payload longer than 80 bytes (plus header) overflows the stack buffer,
overwriting the return address and enabling remote code execution.

### The patch (verified in ghidriff diff, 318 → 434)

The diff confirms vendorID handling was hardened:

- **`IkeLookupVendorId`** (63% match) — added length validation before
  processing the vendorID payload. A new string `s_Ignoring_the_vendor,_received_S`
  was added and is referenced here, indicating oversized vendorIDs are now
  logged and ignored rather than passed to the vulnerable string-conversion path.

- **`IkeHandlePayloadMMVendorId`** (99% match) — near-identical; the overflow
  path was blocked upstream in `IkeLookupVendorId`.

The fix blocks vendorID payloads whose data length exceeds the expected bounds
before `WfpBytesToString` is ever called.

Diff: `ghidriff/CVE-2022-21849/output/ikeext-10.0.22000.318.dll-ikeext-10.0.22000.434.dll.ghidriff.md`

---

## Reaching the bug — network path

Fully remote, no authentication required:

```
Attacker (any IP)
    │
    ▼
UDP/500 → target Windows host
    │
    ▼
ikeext!IkeLookupVendorId
    │   VendorID payload with vendorID == 0x1000
    │   Data length > 80 bytes
    ▼
ikeext!IkeHandleSecurityRealmVendorId
    │
    ▼
ikeext!WfpBytesToString
    │
    ▼
strcpy(dest=v35[80], src=attacker_data)  ← stack overflow
```

| Element | Value |
|---|---|
| Protocol | UDP/500 (IKEv2) |
| Vulnerable functions | `ikeext!IkeLookupVendorId`, `ikeext!IkeHandleSecurityRealmVendorId`, `ikeext!WfpBytesToString` |
| Vendor ID | `0x1000` ("MSFT IPsec Security Realm Id") |
| Buffer | 80-byte stack buffer `v35` |
| Privileges | none (unauthenticated, remote) |
| Prerequisites | Windows host with IPsec/IKEv2 service running |

---

## Detection engineering

- **Network IDS**: Alert on IKEv2 VendorID payload with vendorID `0x1000` and
  data length > 80 bytes. This is abnormal — the legitimate MSFT Security Realm
  ID is typically small.
- **Windows Event Log**: IKEv2 negotiation failures in
  `Microsoft-Windows-IKE/Operational`.
- **Crash forensics**: Stack corruption / bugcheck in `ikeext!WfpBytesToString`
  or `ikeext!IkeHandleSecurityRealmVendorId` with a long vendorID payload on
  the stack.

## References

- [MSRC — CVE-2022-21849](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21849)
- [78 Research Lab — IKEv2 VendorID stack overflow](https://blog.78researchlab.com/53e53729-d728-4635-a58d-08ad8a1f68e4)