Vulnerability in wireguard: socket: free skb in send6 when ipv6 is disabled
Summary
GSD-2022-1001113: wireguard: socket: free skb in send6 when ipv6 is disabled. Affects Kernel versions >= e7096c131e5161fa3b8e52a650d7719d2857adfd, < 0b19bcb753dbfb74710d12bb2761ec5ed706c726. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wireguard package is a kernel module that provides a secure network tunneling solution. It allows users to create virtual private networks (VPNs) that can securely transmit data over public networks. This vulnerability affects the wireguard package when IPv6 is disabled. IPv6 is a network protocol that enables the identification and location of devices on the internet. When IPv6 is disabled, the wireguard socket may incorrectly free skb (socket buffer) in the send6 function, leading to potential security issues.
Vulnerability Detail
The vulnerability arises from a flaw in the wireguard socket code. When IPv6 is disabled, the send6 function in the wireguard socket may free skb, which can result in memory corruption or other security vulnerabilities. The impact and attack plausibility of this vulnerability have not been proven yet. It is important to note that this vulnerability has been fixed in Linux Kernel version v5.17.2 by commit 0b19bcb753dbfb74710d12bb2761ec5ed706c726. The vulnerability was introduced in version v5.6 by commit e7096c131e5161fa3b8e52a650d7719d2857adfd.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the wireguard package to the fixed version.
Conclusion
The wireguard package is vulnerable to a socket-related issue when IPv6 is disabled. This vulnerability has been fixed in Linux Kernel version v5.17.2. It is important to update the wireguard package and associated kernel to the latest version to ensure the security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Wireguard is a kernel module that provides a secure network tunneling solution. It allows users to create virtual private networks (VPNs) that can securely transmit data over public networks.
The impact of this vulnerability is not yet proven. However, if exploited, it could lead to memory corruption or other security vulnerabilities.
To fix this vulnerability, update the wireguard package to version v5.17.2 or later by updating the Linux Kernel.
There is no specific workaround mentioned for this vulnerability. It is recommended to update the wireguard package to the fixed version.
This vulnerability was discovered through code analysis and security testing.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
