CVE-2022-49153

wireguard: socket: free skb in send6 when ipv6 is disabled

Medium · published February 26, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wireguard: socket: free skb in send6 when ipv6 is disabled

I got a memory leak report:

unreferenced object 0xffff8881191fc040 (size 232):

comm "kworker/u17:0", pid 23193, jiffies 4295238848 (age 3464.870s)

hex dump (first 32 bytes):

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace:

[<ffffffff814c3ef4>] slab_post_alloc_hook+0x84/0x3b0

[<ffffffff814c8977>] kmem_cache_alloc_node+0x167/0x340

[<ffffffff832974fb>] __alloc_skb+0x1db/0x200

[<ffffffff82612b5d>] wg_socket_send_buffer_to_peer+0x3d/0xc0

[<ffffffff8260e94a>] wg_packet_send_handshake_initiation+0xfa/0x110

[<ffffffff8260ec81>] wg_packet_handshake_send_worker+0x21/0x30

[<ffffffff8119c558>] process_one_work+0x2e8/0x770

[<ffffffff8119ca2a>] worker_thread+0x4a/0x4b0

[<ffffffff811a88e0>] kthread+0x120/0x160

[<ffffffff8100242f>] ret_from_fork+0x1f/0x30

In function wg_socket_send_buffer_as_reply_to_skb() or wg_socket_send_

buffer_to_peer(), the semantics of send6() is required to free skb. But

when CONFIG_IPV6 is disable, kfree_skb() is missing. This patch adds it

to fix this bug.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.9th percentile
Published
2025-02-26T01:55Z
EPSS history
Timeline
  • 26 FEB 01:55Z
    wireguard: socket: free skb in send6 when ipv6 is disabled
    cvelistv5