Vulnerability in wireguard: socket: ignore v6 endpoints when ipv6 is disabled
Summary
GSD-2022-1001759: wireguard: socket: ignore v6 endpoints when ipv6 is disabled. Affects Kernel versions >= e7096c131e5161fa3b8e52a650d7719d2857adfd, < 9af42a4f6d81b96b123f3ec22a4dcb906c6d00e7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wireguard package is a kernel module that provides a secure network tunneling solution. It allows users to create virtual private networks (VPNs) that can securely transmit data over public networks. Wireguard is integrated into the Linux Kernel and is widely used for its simplicity and performance. However, a vulnerability has been discovered in the socket implementation of wireguard when IPv6 is disabled.
Vulnerability Detail
The vulnerability in wireguard's socket implementation occurs when IPv6 is disabled. In this scenario, wireguard should ignore IPv6 endpoints, but due to a coding error, it does not properly handle v6 endpoints. This vulnerability could potentially be exploited by an attacker to bypass network restrictions or launch attacks against wireguard-enabled systems. It is important to note that the impact and attack plausibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround is to enable IPv6 on the system. By enabling IPv6, wireguard will properly handle v6 endpoints and mitigate the vulnerability. However, it is still recommended to update the kernel as soon as possible.
Conclusion
In conclusion, a vulnerability has been discovered in wireguard's socket implementation when IPv6 is disabled. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.15.33 or later. Enabling IPv6 on the system can serve as a temporary workaround. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Wireguard is a kernel module that provides a secure network tunneling solution. It allows users to create virtual private networks (VPNs) that can securely transmit data over public networks.
The impact of this vulnerability is not yet proven. However, if exploited, it could potentially allow an attacker to bypass network restrictions or launch attacks against wireguard-enabled systems.
To fix this vulnerability, update your Linux Kernel to version v5.15.33 or later. Regularly updating the kernel is recommended to ensure the latest security patches are applied.
A temporary workaround is to enable IPv6 on the system. This will ensure wireguard properly handles v6 endpoints and mitigates the vulnerability. However, updating the kernel is still recommended.
For more information about this vulnerability, you can refer to the official Linux Kernel repository or the vulnerability database provided by the Cloud Security Alliance.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
