Vulnerability in wireguard: socket: free skb in send6 when ipv6 is disabled
Summary
GSD-2022-1002028: wireguard: socket: free skb in send6 when ipv6 is disabled. Affects Kernel versions >= e7096c131e5161fa3b8e52a650d7719d2857adfd, < 096f9d35cac0a0c95ffafc00db84786b665a4837. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WireGuard is a free and open-source software application and communication protocol that implements virtual private network (VPN) techniques to create secure point-to-point connections. It is designed to be fast, secure, and easy to use. The vulnerability affects the wireguard package in the Linux Kernel.
Vulnerability Detail
The vulnerability in wireguard allows an attacker to free skb (socket buffer) in send6 when IPv6 is disabled. This can lead to a use-after-free vulnerability, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. The vulnerability was introduced in version v5.6 of the Linux Kernel and is fixed in version v5.10.110.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a workaround for this vulnerability is to enable IPv6 on the system. By enabling IPv6, the vulnerability is mitigated as the skb will not be freed when sending IPv6 packets. To enable IPv6, the system administrator can follow the appropriate instructions for their operating system or distribution.
Conclusion
In conclusion, the vulnerability in wireguard: socket: free skb in send6 when ipv6 is disabled can be mitigated by updating the Linux Kernel to version v5.10.110 or later. Alternatively, enabling IPv6 on the system can serve as a workaround. It is important to stay updated with the latest security patches and follow best practices for securing network connections.
See every vulnerability recorded for Kernel →
FAQ
WireGuard is a free and open-source software application and communication protocol that implements virtual private network (VPN) techniques to create secure point-to-point connections.
The vulnerability allows an attacker to free skb in send6 when IPv6 is disabled, potentially leading to a use-after-free vulnerability and allowing arbitrary code execution or causing a denial-of-service (DoS) condition.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.110 or later. Instructions for updating the Linux Kernel can be found in the official repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/).
Yes, a workaround for this vulnerability is to enable IPv6 on the system. By enabling IPv6, the vulnerability is mitigated as the skb will not be freed when sending IPv6 packets.
For more information about this vulnerability, you can refer to the vulnerability details in the Open Source Vulnerability format provided by the Cloud Security Alliance. You can also reach out to info@devnack.com for further support on vulnerability remediation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
