Executive brief
Zephyr's WireGuard implementation, used to establish secure VPN tunnels in embedded systems, failed to authenticate certain keepalive packets before accepting them. An attacker on the network could forge keepalive messages without knowing the session key, causing the system to incorrectly report the peer as connected. While the vulnerability does not allow traffic injection or key disclosure, it can deceive monitoring systems and disrupt reliability expectations.
Technical details
The vulnerability is an authentication bypass in the WireGuard implementation's keepalive packet handling (wg_process_data_message in wg_crypto.c). When a 16-byte type-4 transport-data message is received—the size of an empty plaintext plus Poly1305 tag—the code accepted it and returned early without calling wg_decrypt_packet(), skipping Poly1305 authentication tag verification. An attacker with network access to the WireGuard UDP port could brute-force or observe the 32-bit cleartext receiver index, then send a forged keepalive packet that would be accepted despite not possessing the session key. The impact is limited to spoofing NET_EVENT_VPN_CONNECTED signals; no plaintext decryption, key disclosure, or traffic injection occurs. The fix enforces cryptographic verification of all 16-byte payloads by removing the early-return path and routing them through standard decryption and replay checks.
Affected products
- Zephyr Project Zephyr RTOS unspecified
Timeline
- 2026-08-28: disclosed