CVE-2025-30334

Executive Summary

CVE-2025-30334 is a denial-of-service vulnerability in OpenBSD's wg(4) (WireGuard) kernel driver, affecting versions 7.6 before errata 006 and 7.5 before errata 015. An unauthenticated remote attacker can send specially crafted traffic over a WireGuard interface, causing a NULL pointer dereference and kernel crash. The vulnerability has a CVSS score of 6.5 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood. No public proof-of-concept or exploit code is available. The vendor has released errata patches, but no OSV or GitHub advisory exists.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N) – remote exploitation possible.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: None (C:N) – no data exposure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: High (A:H) – kernel crash leads to denial of service.
• Threat Level: Medium – remote DoS with low complexity, but no public exploit.

Deep Dive & Mechanics

The vulnerability resides in the wg(4) kernel driver, which implements the WireGuard VPN protocol. WireGuard uses UDP packets for encrypted tunnel traffic. The flaw is a NULL pointer dereference (CWE-476) triggered when processing malformed or specially crafted WireGuard handshake or data packets. When the driver attempts to access a pointer that has not been properly initialized or has been freed, the kernel panics, causing a system crash.

The attack vector is network-based: an attacker sends malicious UDP packets to the WireGuard listening port (typically 51820/udp). The driver fails to validate certain packet fields or state transitions, leading to a NULL pointer dereference. This is a classic denial-of-service vulnerability that does not require authentication or prior knowledge of the tunnel.

The vulnerability affects OpenBSD 7.6 before errata 006 and 7.5 before errata 015. The patches likely add proper NULL checks or input validation in the wg(4) driver.

Vulnerable vs. Patched Code

The exact code diff is not publicly available, but based on the CWE-476 classification, the vulnerable code likely resembles:

// Vulnerable code (pseudo)
struct wg_peer *peer = wg_peer_lookup(skb);
if (peer->state == WG_PEER_STATE_ESTABLISHED) { // NULL pointer dereference if peer is NULL
    // process packet
}

The patched version would add a NULL check:

// Patched code (pseudo)
struct wg_peer *peer = wg_peer_lookup(skb);
if (peer == NULL) {
    return -EINVAL;
}
if (peer->state == WG_PEER_STATE_ESTABLISHED) {
    // process packet
}

Exploitation & Lab Setup

Red Team

No public exploit code is available. To test the vulnerability in a lab:

1. Setup: Deploy two OpenBSD VMs (7.6 without errata 006). Configure WireGuard on one as a server.
2. Craft Malicious Packet: Use scapy or hping3 to send malformed UDP packets to the WireGuard port (51820/udp). Example with scapy:

from scapy.all import *
send(IP(dst="192.168.1.100")/UDP(sport=51820, dport=51820)/Raw(load="\x00"*100))

3. Trigger Crash: Send a burst of such packets. The kernel may crash immediately or after a few packets.

Blue Team

• Detection: Monitor for kernel panics or system crashes on OpenBSD systems running WireGuard. Use dmesg to check for NULL pointer dereference errors.
• Mitigation: Apply the errata patches immediately. If patching is not possible, restrict access to the WireGuard port using firewall rules (e.g., pf.conf):

block in on egress proto udp to port 51820

• Honeypot: Deploy a fake WireGuard service on a non-production system to capture attack traffic.

Indicators of Compromise (IOCs)

• Network: UDP packets to port 51820 with malformed payloads (e.g., all zeros, invalid handshake types).
• System: Kernel panic logs containing wg(4) or NULL pointer dereference in /var/log/messages or dmesg.
• File: No specific file IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_30334_WireGuard_NULL_Deref {
    meta:
        description = "Detects malformed WireGuard packets targeting CVE-2025-30334"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-30334"
    strings:
        $wg_header = { 01 00 00 00 }  // WireGuard handshake initiation type
        $null_payload = { 00 00 00 00 00 00 00 00 }
    condition:
        $wg_header at 0 and $null_payload
}

Sigma Rule

title: CVE-2025-30334 WireGuard Kernel Crash Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects kernel panic logs related to wg(4) NULL pointer dereference
author: Valters IT
date: 2025-04-01
logsource:
    product: openbsd
    service: kernel
detection:
    selection:
        EventID: 1
        Message|contains: 'wg(4)'
    condition: selection
falsepositives:
    - Legitimate WireGuard driver bugs
level: high

Suricata Rule

alert udp any any -> any 51820 (msg:"CVE-2025-30334 WireGuard Malformed Packet"; content:"|01 00 00 00|"; depth:4; content:"|00 00 00 00|"; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply OpenBSD errata 006 for 7.6 or errata 015 for 7.5 immediately.
2. Workaround: If patching is delayed, block inbound UDP traffic to port 51820 from untrusted networks using pf or ipfw.
3. Monitoring: Enable kernel logging and monitor for crashes. Use the provided Sigma rule for SIEM integration.
4. Network Segmentation: Isolate WireGuard interfaces from critical systems.

Valters IT
Securing OpenBSD, one patch at a time.