CVE-2024-26951

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: check for dangling peer via is_dead instead of empty list

If all peers are removed via wg_peer_remove_all(), rather than setting

peer_list to empty, the peer is added to a temporary list with a head on

the stack of wg_peer_remove_all(). If a netlink dump is resumed and the

cursored peer is one that has been removed via wg_peer_remove_all(), it

will iterate from that peer and then attempt to dump freed peers.

Fix this by instead checking peer->is_dead, which was explictly created

for this purpose. Also move up the device_update_lock lockdep assertion,

since reading is_dead relies on that.

It can be reproduced by a small script like:

echo "Setting config..."

ip link add dev wg0 type wireguard

wg setconf wg0 /big-config

(

while true; do

echo "Showing config..."

wg showconf wg0 > /dev/null

done

) &

sleep 4

w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References