Summary
A WireGuard endpoint-handling flaw accepts a peer address from an unauthenticated transport-data message when no matching session exists. A network attacker able to send UDP traffic to the WireGuard listener may redirect subsequent handshakes and tunnel traffic, causing denial of service and potentially exposing traffic metadata through relaying, while WireGuard's cryptography continues to protect tunnel contents.
A WireGuard endpoint-handling flaw accepts a peer address from an unauthenticated transport-data message when no matching session exists. A network attacker able to send UDP traffic to the WireGuard listener may redirect subsequent handshakes and tunnel traffic, causing denial of service and potentially exposing traffic metadata through relaying, while WireGuard's cryptography continues to protect tunnel contents.
Affected context
The issue occurs in WireGuard deployments using the affected experimental implementation when a peer has no valid handshake or current keypair, such as during startup or after session expiration. The listener accepts UDP datagrams without a remote address or port filter, and the vulnerable path updates the peer endpoint before authenticating the message. Deployments in which peers actively initiate authenticated handshakes may reduce persistence of the redirection, but do not eliminate the underlying flaw.
The issue occurs in WireGuard deployments using the affected experimental implementation when a peer has no valid handshake or current keypair, such as during startup or after session expiration. The listener accepts UDP datagrams without a remote address or port filter, and the vulnerable path updates the peer endpoint before authenticating the message. Deployments in which peers actively initiate authenticated handshakes may reduce persistence of the redirection, but do not eliminate the underlying flaw.
Exploit preconditions
- Attack surface: The WireGuard UDP listener and its transport-data handling path
- Required access: Ability to send UDP datagrams to the listener's reachable address and port; access to legitimate tunnel traffic is not required
- Trigger point: Receipt of a transport-data message while the peer lacks a valid handshake or current keypair
- Why exploitation is possible: The implementation uses the datagram source address to update the peer endpoint before a cryptographic identity or message authentication check succeeds
- Attack surface: The WireGuard UDP listener and its transport-data handling path
- Required access: Ability to send UDP datagrams to the listener's reachable address and port; access to legitimate tunnel traffic is not required
- Trigger point: Receipt of a transport-data message while the peer lacks a valid handshake or current keypair
- Why exploitation is possible: The implementation uses the datagram source address to update the peer endpoint before a cryptographic identity or message authentication check succeeds
Why this happens
The root cause is an unauthenticated state update in a protocol path that handles messages with an unknown receiver index. When no session key is available, the message cannot be cryptographically verified, yet its source address is copied into the peer endpoint and later used for handshake and data transmission.
This behavior maps primarily to CWE-346: Origin Validation Error, because network-origin information is trusted without validating that it belongs to the authenticated peer. It also relates to CWE-306: Missing Authentication for Critical Function, since changing a routing-critical endpoint is permitted without authentication.
The root cause is an unauthenticated state update in a protocol path that handles messages with an unknown receiver index. When no session key is available, the message cannot be cryptographically verified, yet its source address is copied into the peer endpoint and later used for handshake and data transmission.
This behavior maps primarily to CWE-346: Origin Validation Error, because network-origin information is trusted without validating that it belongs to the authenticated peer. It also relates to CWE-306: Missing Authentication for Critical Function, since changing a routing-critical endpoint is permitted without authentication.
Potential impact
- An attacker may redirect handshake initiations and encrypted packets away from the legitimate peer.
- The tunnel could remain unavailable until an authenticated endpoint update or other recovery event occurs.
- An attacker could selectively drop, delay, or relay redirected traffic.
- Traffic metadata and communication patterns may be exposed through relay positioning.
- The attacker should not be able to decrypt or forge tunnel contents solely through this flaw.
- An attacker may redirect handshake initiations and encrypted packets away from the legitimate peer.
- The tunnel could remain unavailable until an authenticated endpoint update or other recovery event occurs.
- An attacker could selectively drop, delay, or relay redirected traffic.
- Traffic metadata and communication patterns may be exposed through relay positioning.
- The attacker should not be able to decrypt or forge tunnel contents solely through this flaw.
General mitigation guidance
Mitigation generally focuses on ensuring that endpoint learning is driven only by authenticated protocol state.
Defensive design patterns include:
- Update peer endpoints only after successful handshake authentication or authenticated, replay-protected data processing.
- Prefer a configured endpoint when no authenticated endpoint is available.
- Drop messages that cannot be associated with a valid authenticated session rather than learning routing state from them.
- Treat packet source addresses as untrusted metadata and avoid using them for security-sensitive state changes.
- Apply restrictive network policy to the WireGuard listener where operationally appropriate.
- Run the VPN service with least privilege and monitor unexpected endpoint changes.
Mitigation generally focuses on ensuring that endpoint learning is driven only by authenticated protocol state.
Defensive design patterns include:
- Update peer endpoints only after successful handshake authentication or authenticated, replay-protected data processing.
- Prefer a configured endpoint when no authenticated endpoint is available.
- Drop messages that cannot be associated with a valid authenticated session rather than learning routing state from them.
- Treat packet source addresses as untrusted metadata and avoid using them for security-sensitive state changes.
- Apply restrictive network policy to the WireGuard listener where operationally appropriate.
- Run the VPN service with least privilege and monitor unexpected endpoint changes.
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying writes to security-sensitive endpoint or routing state before authentication checks.
- Code review checks that compare every endpoint update with the protocol's authentication and anti-replay boundaries.
- Tests that send unauthenticated or unknown-session traffic during startup and key-expiration states and verify that peer endpoints remain unchanged.
- Runtime telemetry or policy enforcement for unexpected peer endpoint changes, especially changes triggered before a successful handshake.
- Automated security review tools that flag trust in packet source addresses without cryptographic origin validation.
Organizations can look for this class of issue through:
- Static analysis rules identifying writes to security-sensitive endpoint or routing state before authentication checks.
- Code review checks that compare every endpoint update with the protocol's authentication and anti-replay boundaries.
- Tests that send unauthenticated or unknown-session traffic during startup and key-expiration states and verify that peer endpoints remain unchanged.
- Runtime telemetry or policy enforcement for unexpected peer endpoint changes, especially changes triggered before a successful handshake.
- Automated security review tools that flag trust in packet source addresses without cryptographic origin validation.
