DF-3390

Handshake replay timestamp compare uses non-constant-time memcmp (OpenBSD hardened this to fixedtime_bcmp)

Summary

noise_consume_initiation() compares the decrypted TAI64N timestamp against r->r_timestamp with plain memcmp, leaking the position of the first differing byte through timing; the same file uses timingsafe_bcmp for public-key and psk comparisons, and OpenBSD's wg uses fixedtime_bcmp here. Functionally correct (big-endian lexicographic == numeric) and identical to the FreeBSD upstream this file was ported from - defense-in-depth only (the accept/reject oracle already exists). Fix: constant-time ordering compare over the 12 bytes. [VERIFIED pass2: plain memcmp replay compare vs timingsafe_bcmp elsewhere confirmed; timing not measurable on rig; constant-time fix compiled via wg module build]

Discussion (0)

No comments yet.

Severity: Info
Status: new
Bucket: Base system — network stack
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-203
File: sys/net/wg/wg_noise.c
Lines: 1143
Area: net
Discovered: 2026-09-12
Updated: 2026-09-12

Team triage

untriaged

priority: — · owner: —

PoC verification

not_reproduced

Status: not_reproduced
Reproduced: no
Impact: none
Confidence: certain
Tested: 2026-10-26 04:39:05
Attempts: 0
Runtime: 15s
Code hash: —
Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64
Build cmd: see build.sh
Run cmd: see run.sh

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: —
Patched reproduced: —
Confidence: certain
Tested: 2026-10-26 04:39:05
Runtime: —
Kernel: per-fix-DF-3390
fix.diff: findings/poc/DF-3390/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-3390 · 4 files

File	Type	Size
README.md	—	237 B	↓ raw
fix.diff	—	1.5 KB	view raw
manifest.json	—	347 B	view raw
verdict.json	—	1.6 KB	view raw

README.md

↓ download raw

DF-3390 evidence pack

What

wg handshake replay timestamp compare uses plain memcmp (timing)

Verdict

status=not_reproduced impact=none confidence=certain

See VERDICT.md for the full narrative and fix.diff for the verified fix.

Fix verification

not_testable

compile-validated by building sys/net/wg from the patched tree (if_wg.ko, rc=0, zero errors). No runtime A/B (timing channel).

↓ fix.diffper-fix-DF-3390

Confirmed kernel references

Detail

Evidence (decisive lines)

VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff

PoC changes

n/a - timing channel, no runnable demonstration

Verified recommended fix

constant-time noise_tai64n_cmp() replaces memcmp at the replay check

Verdict

Line-accurate confirmation; a timing side-channel measurement is not meaningfully demonstrable on this rig (and the accept/reject oracle already exists). noise_consume_initiation compares the decrypted TAI64N timestamp with plain memcmp (wg_noise.c:1143) while the same file uses timingsafe_bcmp for public-key/psk comparisons (:503, :651, :1499); OpenBSD hardened this site to fixedtime_bcmp. Functionally correct (big-endian lexicographic == numeric) - defense-in-depth only. Fix adds a constant-time sign-compare helper (noise_tai64n_cmp); compile-validated by building sys/net/wg against the patched tree (module build; wg is not in the F40FIX kernel).