Description
The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in the blocking of traffic" rather than to only WireGuard.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | wireguard | No fix yet | — |
| Ubuntu 22.04 LTS | wireguard | No fix yet | — |
| Ubuntu 20.04 LTS | wireguard | No fix yet | — |
| Ubuntu 18.04 LTS | wireguard | No fix yet | — |
| Ubuntu 16.04 LTS | wireguard | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | wireguard | <= 0.5.3 | — | PYSEC-2023-321 |
Advisories 1
- WID-SEC-2023-2781 SonicWall SMA: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 30, 2023