Junglewise Threat Intelligence

CVE-2024-26951: Linux Kernel WireGuard use-after-free in netlink peer dump

CVE-2024-26951 · Severity: high · CVSS 7.8 · Published 2024-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's WireGuard implementation could allow a local user to crash the system or potentially gain unauthorized access to sensitive information. The issue occurs when the system attempts to display configuration details for a WireGuard interface while peers are being removed. This can lead to a system instability or a 'use-after-free' condition where the software tries to access memory that has already been released.

Technical details

A use-after-free vulnerability exists in the WireGuard netlink handler (drivers/net/wireguard/netlink.c) within the Linux kernel. When all peers are removed via wg_peer_remove_all(), peers are moved to a temporary stack-based list rather than being immediately cleared from the peer_list. If a netlink dump operation (wg_get_device_dump) is resumed and its cursor points to a peer that was just removed, the kernel may attempt to iterate from that peer and access memory that has already been freed. This occurs because the code previously checked for an empty list instead of the 'is_dead' flag. An attacker with local privileges can trigger this race condition to cause a kernel panic or potentially achieve local privilege escalation. The issue has been patched in various stable branches including 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, and 6.8.3.

Affected products

  • Linux Linux Kernel 5.6 to 5.10.215, 5.11 to 5.15.154, 5.16 to 6.1.84, 6.2 to 6.6.24, 6.7 to 6.7.12, 6.8 to 6.8.3

Timeline

  • 2024-03-14: other: Patch authored
  • 2024-05-01: advisory: CVE-2024-26951 published

References

Related threats