Description

Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE_TRANSPORT_DATA packet succeeded, the code committed several peer-state changes — update_peer_addr() (endpoint roaming update), the keypair->last_rx/peer->last_rx liveness timers, and keypair_update() (promote next→current and destroy the previous keypair) — and only afterward called wg_check_replay(). On a replayed packet the replay check returned -EINVAL, but none of the preceding mutations were rolled back. The AEAD tag authenticates content but not freshness, so a replayed-but-authentic transport packet decrypts correctly. An attacker who captures one valid ciphertext off the wire (an on-path or shared-medium observer) can re-inject it from an arbitrary spoofed source address. Reaching the handler requires no credentials: it is driven directly from inbound UDP datagrams via the dispatch in subsys/net/lib/wireguard/wg.c. Because the state mutations committed before the replay check, the replay repoints the peer endpoint to the attacker-chosen source address (roaming hijack), redirecting the victim's subsequent outbound tunnel traffic until the legitimate peer's next packet re-corrects it; it also prematurely destroys the previous keypair and refreshes the RX liveness timer. The tunnel payload stays encrypted under the session keypair, so this is an integrity/availability impact (traffic redirection and session disruption), not payload disclosure. The fix moves wg_check_replay() to immediately after a successful decrypt, before any peer-state mutation, matching the WireGuard specification and the Linux reference implementation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T22:16:46.057Z",
  "pubdate": "2026-08-28T22:16:46.057Z",
  "executiveSummary": "A critical vulnerability exists in the Zephyr project's WireGuard implementation within the subsys/net/lib/wireguard/wg_crypto.c file, specifically in the wg_process_data_message() function.\nThe vulnerability is characterized by an improper validation sequence where anti-replay counter checks are performed after mutable peer-state changes have already been committed.\nAn on-path or shared-medium attacker can exploit this by capturing a valid MESSAGE_TRANSPORT_DATA packet and re-injecting it to induce a state mutation despite the packet being a replay.\nThe impact includes unauthorized endpoint roaming (hijacking the peer's endpoint address), premature keypair destruction, and manipulation of liveness timers, leading to service disruption and traffic redirection.\nNo authentication is required for exploitation as the handler is triggered by unauthenticated inbound UDP datagrams.\nThis flaw represents a deviation from the WireGuard specification, which mandates that replay checks must occur immediately following AEAD decryption to maintain the integrity of the peer-state machine.",
  "technicalDetails": "The root cause is a logic error in the packet processing pipeline of the WireGuard implementation in Zephyr. In the wg_process_data_message() function, the code commits critical peer-state mutations—including update_peer_addr(), liveness timer updates for keypair->last_rx and peer->last_rx, and the promotion/destruction of keypairs via keypair_update()—before executing the anti-replay validation routine, wg_check_replay().\nBecause the AEAD decryption process confirms the authenticity and integrity of the packet contents, the cryptographic layer accepts replayed packets as valid. The vulnerability arises because the implementation assumes the packet is 'new' once it has successfully passed the decryption phase, failing to recognize that a replay can successfully decrypt but still violate the sliding window requirements.\nThe exploitation flow begins with an attacker acting as a network observer, capturing a legitimate encrypted transport packet. The attacker then sends this packet to the Zephyr device from a spoofed or arbitrary source address. Upon receipt, wg_process_data_message() decrypts the packet, validates the authentication tag, and proceeds to update the peer's internal state to match the attacker's source address. Only after these mutations are persisted does the system perform the replay check via wg_check_replay(), which returns -EINVAL. Because the state changes are not rolled back, the malicious effects of the packet are permanent until the next valid packet from the genuine peer arrives.\nThe post-exploitation impact includes a 'roaming hijack' where the device updates its endpoint for the peer to an attacker-controlled address. This causes the device to transmit subsequent outgoing tunnel traffic to the attacker, resulting in a Man-in-the-Middle (MitM) or denial-of-service scenario depending on the attacker's infrastructure. Additionally, the premature destruction of the current session keypair can lead to session instability and forced renegotiation.\nThis vulnerability is strictly an integrity and availability issue; the session keys are not compromised, and payload contents remain encrypted, precluding direct information disclosure of the tunnel traffic. However, the ability to manipulate the peer's connection state without authentication poses a significant risk to the reliability of the WireGuard implementation."
}