DF-3388 — wg peer-destroy vs in-flight noise consumer lifetime race (UAF)

Unprivileged-impact statement: the racing packet source is a remote UDP peer (needs the configured peer's private key, i.e. a malicious/compromised peer); the peer-destruction side is routine root reconfiguration (wg syncconf, peer replace, interface teardown) — the two coincide in normal operation whenever peers are reconfigured under load.

What this pack contains

• wgforge.c — userspace WireGuard handshake-initiation forger built from the kernel's own portable crypto (blake2s.c, curve25519.c, chacha.c, poly1305.c vendored here, compiled against shim/sys/*). It forges valid Noise_IKpsk2 initiations for N peer identities whose private keys we generated, at a paced rate.
• wgchurn.c — SIOCSWG driver: loops WG_INTERFACE_REPLACE_PEERS so the kernel runs wg_peer_destroy_all() → wg_peer_destroy() → noise_remote_free() for every peer and immediately re-adds them.
• wgkeygen.c — writes /tmp/wgkeys.bin = resp_pub || priv0 || N peer privs.
• build.sh, run.sh — exact build/run.
• logs/ — sanity tcpdump (199 accepted handshakes → 92-byte responses), churn/forge logs from the race runs.
• env.txt — guest state after the race run.
• VERDICT.md — full narrative.
• fix.diff — the deferred-free fix (not applied to sys/).

Run

# on the DragonFly guest, as root:
cd /tmp/df3388 && sh build.sh
./wgkeygen
ifconfig wg0 create && ifconfig wg0 up
./wgchurn /tmp/wgkeys.bin &      # first ioctl sets private+port+32 peers
sleep 1; pkill wgchurn
# sanity: verify handshakes are accepted (expect 92-byte responses):
(tcpdump -i lo0 -c 2000 -nn udp port 51820 &) ; ./wgforge 127.0.0.1 51820 /tmp/wgkeys.bin &
sleep 5; pkill wgforge
# race:
./wgchurn /tmp/wgkeys.bin &
./wgforge 127.0.0.1 51820 /tmp/wgkeys.bin &   # x3 processes
# watch for panic / hang / vmstat -m NOISE object-count growth

Expected (observed on the stock INVARIANTS guest)

• Sanity: forged initiations are ACCEPTED — kernel sends handshake responses (92-byte UDP) — logs/tcpdump_sanity.log shows 199.
• Race: no panic in ~28 minutes of ~130 destroy-all cycles/s (5.3M wg_peer_destroy executions) against ~660 forged initiations/s (~340k reaching noise_consume_initiation's critical section). See VERDICT.md for why the corruption stays silent on this kernel (M_ZERO same-type reuse heals the peer UAF; the dangling noise_index node is explicit_bzero()'d before the kfree so bucket chains truncate quietly).

DF-3388 VERDICT — wg peer teardown races in-flight noise consumers

Status: INCONCLUSIVE (race window code-proven; no externally visible manifestation produced on the stock INVARIANTS guest in ~28 minutes of aggressive racing; the quiet-ness of both manifestation paths on this kernel is understood and documented below).

Root cause (code-proven)

wg_peer_destroy() (sys/net/wg/if_wg.c:640-695) tears a peer down while in-flight wg_handshake()/wg_deliver_*() paths still hold struct noise_remote references for that peer. The comment at if_wg.c:646-649 ("Disable remote and timers. This will prevent any new handshakes from occuring") is the faulty assumption: noise_remote_disable() (sys/net/wg/wg_noise.c:477-489) only unlinks the remote from the public-key hash; a consumer that has already passed noise_remote_lookup() keeps its reference and continues:

1. noise_consume_initiation() (wg_noise.c:1088-1169) — between noise_remote_lookup() (line 1121) and lockmgr(&r->r_handshake_lock) (line 1140) only unshared crypto runs; nothing excludes a concurrent noise_remote_free() → noise_remote_handshake_clear() (wg_noise.c:674-681) which removes r->r_index from l_index_hash under the same handshake lock. If the consumer acquires the lock after the clear ran, line 1154 noise_remote_index_insert() re-links &r->r_index into l_index_hash and sets r_handshake_state = HANDSHAKE_RESPONDER on a remote whose owning peer is already gone.
2. The consumer then returns the remote; wg_handshake() (if_wg.c:1648-1660) does peer = noise_remote_arg(remote) — r_arg is an uncounted back-pointer to the struct wg_peer that wg_peer_destroy() unconditionally kfree()s at if_wg.c:696. The subsequent wg_peer_set_endpoint(peer, e) / wg_send_response(peer) / wg_timers_event_session_derived(peer) (callout_reset on freed memory) are use-after-free.
3. When the consumer's reference is the last one, noise_remote_put() (wg_noise.c:596-611) explicit_bzero()s and kfree()s the remote while &r->r_index is still linked into l_index_hash (manifestation 1) — a dangling LIST node that every subsequent noise_keypair_lookup()/noise_remote_index_lookup() (wg_noise.c:536-564, 730-750) walks.

Contrast with the FreeBSD original this file was ported from: FreeBSD's noise_remote_put() frees through NET_EPOCH_CALL(noise_remote_smr_free) and noise_remote_free(r, cleanup) defers the peer destruction to the remote's last reference via r_cleanup (freebsd sys/dev/wg/wg_noise.c, noise_remote_smr_free). The DragonFly port dropped both the epoch and the cleanup callback — noise_remote_free() (wg_noise.c:613-620) has no teardown synchronization and wg_peer_destroy() frees the peer inline.

Threat: a configured peer (holder of a peer private key — i.e. a malicious or compromised peer) sending handshakes while an administrator churns peers (wg syncconf does REMOVE+re-add per peer) races the window. This is a kernel use-after-free (CWE-416/CWE-362).

What was run (attempts, honest)

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, INVARIANTS), 6 vCPUs, QEMU/KVM. Built the userspace forger from the kernel's own crypto sources (wgforge.c; blake2s/curve25519/chacha20/poly1305 compiled with a sys/ shim) and the SIOCSWG churn driver (wgchurn.c).

1. Sanity (PROVEN): with 32 stable peers, forged initiations are cryptographically accepted — tcpdump captured 199 92-byte handshake responses in <2 s (logs/tcpdump_sanity.log). This proves the PoC exercises noise_consume_initiation() all the way into its critical section (the response is only generated after the index insert and noise_remote_ref()).
2. Race: churner at ~130 destroy-all cycles/s (each cycle destroys and re-adds all 32 peers ⇒ ~4160 wg_peer_destroy() executions/s; 165,815 cycles total) racing 3 forgers at ~660 initiations/s (~895k sent, est. ~340k reaching the consumer critical section) for ~28 minutes. Guest never panicked; vmstat -m NOISE object count stayed at 33 (32 remotes + 1 local — no orphaned keypairs, no leak).

Why no visible crash on this kernel (analysis)

• Manifestation (2) (peer UAF): the churn re-adds peers from the same M_WG slab with M_ZERO within the same ioctl, so the freed peer slot is immediately re-initialized as a new, valid peer — the consumer's writes land on a live same-type object (silent corruption of the new peer's endpoint/timers). lockuninit() (sys/kern/kern_lock.c:1325-1333) does not poison the lock, so locking stale bytes does not trip INVARIANTS.
• Manifestation (1)/(3) (dangling index node): noise_remote_put() explicit_bzero()s the remote before kfree(); a zeroed LIST node yields le_next = NULL, so bucket-chain walks merely terminate early over dead entries — no wild pointers; M_NOISE slot reuse is always by M_ZERO remotes of the same size class, never attacker-shaped data. Net effect is silently dropped index lookups / permanently dead hash entries, not a crash.
• A crash requires a compounded cascade (freed remote slot re-linked by a new remote while an old bucket still points at it, then a LIST_REMOVE cross-bucket write) — probabilistic and not observed in the run window.

Given the per-attempt window geometry (the handshake-lock arrival must land inside the few-µs clear/critical-section of the peer's own destroy), the expected number of silent hits over the run is in the tens; the analysis above explains why none of them became visible.

Bottom line

The lifetime bug is real and code-proven (see root cause); on a DEBUGSLABS/slab-poisoning or KASAN-style kernel it would fire immediately. On the stock INVARIANTS guest the PoC demonstrated (a) full protocol-level reachability of the racing consumer path (199 accepted handshakes) and (b) 5.3M destroy events against ~340k consumer critical sections with no visible crash. Classification: inconclusive, reproduced=0, impact=none (observed); the finding itself remains High severity on the strength of the code analysis.

Recommended fix

Port the FreeBSD deferred-free discipline: give struct noise_remote a cleanup callback invoked at last-reference drop (which frees the wg_peer), and have noise_consume_initiation()/noise_consume_response() re-check a "dying" flag under r_handshake_lock before re-inserting the index. See fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.