DF-0319
Lockless torn reads of multi-word struct wg_endpoint in fast paths
Summary
wg_peer_set_endpoint(:750)/get_endpoint(:761) unlocked memcmp of entire struct wg_endpoint(28+ bytes) before lock. Concurrent writer under lock -> torn read -> mixed endpoint address. AEAD encryption prevents confidentiality leak. Reliability issue only.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0319 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 383 B | view raw |
Fix verification
not_testablebaseline reproduced→ patch + rebuild →patched clean
recommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/wg/if_wg.c:746: lockless torn reads of multi-word struct wg_endpoint in fast paths
Verified recommended fix
Source-confirmed at sys/net/wg/if_wg.c:746: lockless torn reads of multi-word struct wg_endpoint in fast paths
Verdict
Source-confirmed at sys/net/wg/if_wg.c:746: lockless torn reads of multi-word struct wg_endpoint in fast paths
No comments yet.