# CVE-2022-34721 — Windows IKEv2 Extension `ikeext.dll` Heap Out-of-Bounds Read

---

## Summary

| **Product** | Microsoft Windows — `ikeext.dll` (IKE and AuthIP IPsec Keying Modules) |
|---|---|
| **Vendor** | Microsoft Corporation |
| **Severity** | CVSS v3.1 **8.1 (High)** |
| **CVE Title** | Windows IKE Extension Remote Code Execution Vulnerability |
| **CWE** | CWE-125 (Out-of-bounds Read) |
| **Affected Versions** | Windows 10/11 and Server with IPsec/IKEv2 enabled |
| **Impact** | Remote — unauthenticated attacker sends crafted IKEv2 fragments → RCE/info-disclosure |
| **Exploited ITW** | No |
| **Patch Date** | September 2022 Patch Tuesday |
| **Public analysis** | [78 Research Lab — IKEv2 frag OOB](https://blog.78researchlab.com/9ed22cda-216f-434a-b063-ed78aafa4a7a) |

---

## Root Cause

Windows IKEv2 extension (`ikeext.dll`) handles IKEv2 negotiation for IPsec VPNs.
When receiving fragmented IKEv2 payloads, the reassembly path in
`IkeQueueRecvRequest` allocates a buffer for merged fragment data:

```c
// Simplified vulnerable path
bufferSize = /* derived from attacker-controlled fragment headers */;
pBuffer = WfpMemAlloc(bufferSize);   // no max-size check
// ... copy merged fragment data ...
// Later: access pBuffer[3] without verifying bufferSize >= 4
```

The `bufferSize` is computed from attacker-controlled IKEv2 fragmentation
headers without upper-bound validation. After copying the merged fragments,
the code accesses `pBuffer[3]` (offset 3 into the buffer). If `bufferSize` is
less than 4, this causes a **heap out-of-bounds read**.

On systems with heap metadata protections, the OOB read may be limited to
information disclosure. However, with precise heap grooming, it can lead to
controlled memory corruption and remote code execution.

### The patch (verified in ghidriff diff, 708 → 978)

The diff confirms multiple IKEv2 packet-processing functions changed:

- **`IkeDecryptOakNDPacket`** (53% match) — major rewrite. Added
  `IkeVerifyIncomingDataSize` call **before** any buffer allocation or copy,
  validating the declared packet size against the actual incoming data length.
  Added ETW telemetry for invalid packets (`s_Invalid_packet_format`).

- **`IkeQueueRecvRequest`** (83% match) — modified to propagate the verified
  size down the reassembly path.

- **`IkeParseRecvAncillaryInfo`** (81% match) — streamlined.

- **`IkeVerifyPacketHeader`** (69% match) — added header sanity checks.

The fix centers on `IkeVerifyIncomingDataSize`: any fragmentation payload with
a size field larger than the actual UDP payload is rejected early, preventing
the undersized `WfpMemAlloc`.

Diff: `ghidriff/CVE-2022-34721/output/ikeext-10.0.22000.708.dll-ikeext-10.0.22000.978.dll.ghidriff.md`

---

## Reaching the bug — network path

Fully remote, no authentication required:

```
Attacker (any IP)
    │
    ▼
UDP/500 → target Windows host
    │
    ▼
ikeext!IkeQueueRecvRequest
    │   IKEv2 fragmentation payload with small/malformed fragment headers
    ▼
WfpMemAlloc(bufferSize)  ← undersized allocation
    │
    ▼
memcpy(merged_frag_data)  ← may copy less than expected
    │
    ▼
access pBuffer[3]  ← OOB read if bufferSize < 4
```

| Element | Value |
|---|---|
| Protocol | UDP/500 (IKEv2) |
| Vulnerable function | `ikeext!IkeQueueRecvRequest` |
| Allocation | `WfpMemAlloc` (WFP heap) |
| Trigger | IKEv2 fragmentation payload with malformed size fields |
| Privileges | none (unauthenticated, remote) |
| Prerequisites | Windows host with IPsec/IKEv2 service running (default on many Server SKUs) |

---

## Detection engineering

- **Network IDS**: Alert on IKEv2 fragmentation payloads with abnormally small
  or inconsistent fragment sizes. Valid IKEv2 fragments should have coherent
  `Total Fragments` × `Fragment Size` == `Message Size`.
- **Windows Event Log**: `Microsoft-Windows-IKE/Operational` may log IKEv2
  negotiation failures; correlate with crash dumps if available.
- **Crash forensics**: Access violation in `ikeext!IkeQueueRecvRequest` with
  `rax`/`rcx` pointing to heap memory just past an allocation boundary.

## References

- [MSRC — CVE-2022-34721](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34721)
- [78 Research Lab — IKEv2 frag OOB](https://blog.78researchlab.com/9ed22cda-216f-434a-b063-ed78aafa4a7a)