Description

Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message whose payload was exactly 16 bytes (an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive) was accepted and returned immediately, before wg_decrypt_packet() was ever called. The Poly1305 authentication tag was therefore never verified; the only preceding gates were a cleartext receiver-index lookup (get_peer_keypair_for_index() on the attacker-supplied data_hdr->receiver) and a non-cryptographic keypair validity/expiry check. The path is reachable entirely from the network: inbound UDP on the WireGuard port is dispatched by wg_input() to handle_transport_data() and then wg_process_data_message(). The 32-bit receiver index is transmitted in cleartext in WireGuard handshake and data messages, so an on-path observer learns it directly and an off-path attacker can brute-force it against the UDP port. Given an active receiving-valid session for that index, an attacker could send a 16-byte garbage payload and have it accepted without possessing the session key. On acceptance the unauthenticated message caused the management layer to observe a spoofed NET_EVENT_VPN_CONNECTED signal (setting peer->first_valid and notifying any net_mgmt listener) and incremented the keepalive-RX statistic. The impact is limited to integrity of this status signal: no plaintext is decrypted or injected, no key is disclosed, and the early-return path did not update the peer endpoint or liveness timers, so there is no traffic-injection, session-takeover, or availability consequence. The fix removes the pre-decrypt early return so a 16-byte payload flows through wg_decrypt_packet(), which verifies the Poly1305 tag over the empty plaintext, followed by the existing anti-replay check; only an authenticated, non-replayed message is then recognised as a keepalive. Forged keepalives now fail the tag check and are counted as decrypt failures.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-28T22:16:46.187Z",
  "pubdate": "2026-08-28T22:16:46.187Z",
  "executiveSummary": "This vulnerability exists within the WireGuard implementation of the Zephyr RTOS, specifically in the processing logic for transport-data messages.\nThe flaw allows for an unauthenticated bypass of the cryptographic verification process for keepalive packets.\nAn attacker can spoof keepalive messages that are accepted by the system without possessing valid session keys, leading to the unauthorized triggering of management layer events, such as NET_EVENT_VPN_CONNECTED.\nThe vulnerability is reachable remotely via inbound UDP packets directed at the WireGuard port. While it does not permit plaintext injection or session hijacking, it allows for the manipulation of system state and diagnostic statistics.\nExploitation requires the attacker to identify a valid 32-bit receiver index, which is transmitted in plaintext, making it vulnerable to on-path observation or off-path brute-force attempts.\nThe primary risk implication is the integrity of connection state signaling within the Zephyr networking stack, potentially misleading management applications or monitoring systems regarding the status of a VPN tunnel.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic within wg_process_data_message() in the file subsys/net/lib/wireguard/wg_crypto.c. The implementation contained an early-return path for transport-data messages with a payload size of exactly 16 bytes, which corresponds to an empty plaintext payload plus a bare Poly1305 authentication tag.\nIn the vulnerable implementation, the check for keepalive packets occurred before the execution of wg_decrypt_packet(). Because the decryption routine is responsible for verifying the Poly1305 authentication tag, the early return effectively bypassed all cryptographic integrity checks for these specific packets.\nThe attack flow begins with the attacker constructing a 16-byte UDP packet. The receiver index, which is included in the WireGuard transport header, must match a currently active session. Because the receiver index is transmitted in the clear, an attacker performing traffic analysis can easily extract it. Alternatively, an off-path attacker can perform a brute-force attack against the 32-bit space to identify an active session index on the target UDP port.\nUpon receiving such a packet, wg_process_data_message() identifies the 16-byte payload and immediately processes it as a legitimate keepalive. This triggers the update of internal state, specifically incrementing the keepalive-RX statistic and emitting a NET_EVENT_VPN_CONNECTED signal to any subscribed net_mgmt listeners. Because no decryption or tag verification is performed, the integrity of the signal is compromised.\nThe vulnerability does not result in memory corruption, remote code execution, or the exposure of session keys, as the early-return path does not affect peer endpoint configuration or liveness timers, thus preventing traffic injection or session takeover. However, it successfully creates a logic bypass that misrepresents the state of the VPN connection. The lack of authentication for the keepalive packet allows an attacker to repeatedly trigger connection-up events, which may cause instability in management layers relying on this event for control flow. The fix involves removing the pre-decrypt early return, ensuring that all 16-byte payloads are passed through wg_decrypt_packet() to enforce Poly1305 tag verification and anti-replay mechanisms before the packet is recognized as a valid keepalive."
}