Vulnerability in wireguard: allowedips
Summary
GSD-2021-1000771: wireguard: allowedips: free empty intermediate nodes when removing single node. Affects Kernel versions >= e7096c131e5161fa3b8e52a650d7719d2857adfd, < df3b45f6d1ce605120750b983fc4448e3769619a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WireGuard is an open-source VPN protocol that aims to provide a simpler and more secure way to establish virtual private networks. It is implemented as a kernel module in the Linux Kernel. The 'allowedips' feature in WireGuard allows users to specify the IP addresses that are allowed to pass through the VPN tunnel. However, a vulnerability has been discovered in the handling of 'allowedips' that can lead to the creation of empty intermediate nodes when removing a single node.
Vulnerability Detail
The vulnerability in WireGuard's 'allowedips' feature allows for the creation of empty intermediate nodes when removing a single node. This can result in memory leaks and potential resource exhaustion. An attacker could potentially exploit this vulnerability to cause a denial of service (DoS) condition or execute arbitrary code with kernel privileges. The vulnerability was introduced in version v5.6 of the Linux Kernel and has been fixed in version v5.10.43.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel and WireGuard to the latest versions.
Conclusion
The vulnerability in WireGuard's 'allowedips' feature can lead to memory leaks and potential resource exhaustion. It is important to update the Linux Kernel and WireGuard to the latest versions to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
WireGuard is an open-source VPN protocol that aims to provide a simpler and more secure way to establish virtual private networks.
The 'allowedips' feature in WireGuard allows users to specify the IP addresses that are allowed to pass through the VPN tunnel.
This vulnerability can lead to memory leaks and potential resource exhaustion. An attacker could potentially exploit this vulnerability to cause a denial of service (DoS) condition or execute arbitrary code with kernel privileges.
To fix this vulnerability, update the Linux Kernel to version v5.10.43 or later and ensure that WireGuard is also updated to the latest version.
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the Linux Kernel and WireGuard to the latest versions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
