Executive brief
A synchronization issue was identified in the WireGuard VPN component of the Linux kernel. This vulnerability involves a data race during the processing of incoming network packets, which could potentially lead to system instability or a denial of service. While the race condition was deemed intentional by developers, it required formal code annotations to ensure the system handles concurrent data access safely.
Technical details
A data race was identified by Syzkaller/KCSAN in the WireGuard 'receive.c' component, specifically involving concurrent access to 'keypair->receiving_counter.counter'. The race occurs between the 'wg_packet_decrypt_worker' (reading the counter) and 'wg_packet_rx_poll' (writing to the counter via 'counter_validate'). This is a race condition (CWE-362) where improper synchronization of shared resources could lead to incorrect counter validation. The fix involves using READ_ONCE() and WRITE_ONCE() macros to ensure atomic access and prevent compiler optimizations that could exacerbate the race. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.7 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2
Timeline
- 2024-03-14: other: Patch authored
- 2024-04-17: advisory: CVE published
References
- https://git.kernel.org/stable/c/3f94da807fe1668b9830f0eefbbf7e887b0a7bc6
- https://git.kernel.org/stable/c/45a83b220c83e3c326513269afbf69ae6fc65cce
- https://git.kernel.org/stable/c/78739d72f16b2d7d549f713f1dfebd678d32484b
- https://git.kernel.org/stable/c/bba045dc4d996d03dce6fe45726e78a1a1f6d4c3
- https://git.kernel.org/stable/c/d691be84ab898cf136a35176eaf2f8fc116563f0
- https://git.kernel.org/stable/c/f87884e0dffd61b47e58bc6e1e2f6843c212b0cc
- https://git.kernel.org/stable/c/fdf16de078a97bf14bb8ee2b8d47cc3d3ead09ed