Executive brief
Zephyr's WireGuard VPN implementation contains a timing vulnerability in how it validates packet freshness. An attacker can capture a legitimate encrypted packet and replay it from a spoofed address, causing the VPN to redirect outbound traffic to the attacker's address or temporarily disrupt the connection. While the encrypted tunnel payload remains protected, this allows traffic interception and denial of service on active VPN sessions.
Technical details
The vulnerability is a replay attack in wg_process_data_message() within subsys/net/lib/wireguard/wg_crypto.c. The code performs AEAD decryption, commits peer state mutations (endpoint address update, keypair promotion, liveness timer refresh), and only then checks the anti-replay counter. On a replayed packet, the replay check fails but the mutations are not rolled back. An on-path or shared-medium observer can capture any valid transport packet and re-inject it from an arbitrary source address without authentication. The replay check validates freshness (which AEAD tags do not), but the prior state changes redirect tunnel traffic to the attacker-chosen address (roaming hijack) or destroy the active keypair prematurely. The fix reorders wg_check_replay() to execute immediately after successful decryption, before state mutation, matching the WireGuard specification.
Affected products
- Zephyr Project Zephyr <UNKNOWN>
Timeline
- 2026-08-28: disclosed