| عنوان | Mullvad wireguard.sys 0.10.1 Denial of Service |
|---|
| الوصف | My name is Raul Mansurov. I am writing to report a security vulnerability discovered during independent research on mullvad-wireguard.sys version 0.10.1.
Severity: Medium (CVSS 3.1: 6.0 — AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Summary:
The AdapterState() IOCTL handler (0xB098C50C) calls ObfReferenceObject() on the caller's EPROCESS object when bringing the adapter UP, but never calls ObfDereferenceObject() when SocketInit() fails. This causes the kernel EPROCESS reference count to be permanently inflated on every failed UP call, leading to NonPagedPool memory exhaustion and eventual system crash (BSOD).
Confirmed impact (kernel debugger evidence):
- EPROCESS PointerCount inflated to 229,469 (normal: 3–10) — confirmed via WinDbg !object
- NonPagedPool grew +217 MB in 373 seconds (single thread)
- 14,300,000+ leaked references accumulated in ~6 minutes (8 threads)
- Kernel memory accounting internally inconsistent after sustained exploitation
- Estimated time to BSOD: ~25 min single-thread, ~3–5 min with 8 threads
Root cause (one line):
ObfDereferenceObject() is missing from the SocketInit() failure path in AdapterState().
Fix:
Add ObfDereferenceObject(SocketOwnerProcess) and clear SocketOwnerProcess to NULL in the failure path — mirroring the balanced teardown already present in the DOWN path.
Which updated by Mullvad wireguard protocol , but not CVE assigned yet . They confirmed it was a vulnerability |
|---|
| المصدر | ⚠️ https://drive.google.com/file/d/1LN68wxIx_2EI4IBVq13UlP4G1aqyz--x/view?usp=sharing |
|---|
| المستخدم | Raulisr00t (UID 99240) |
|---|
| ارسال | 23/06/2026 08:45 PM (2 أشهر منذ) |
|---|
| الاعتدال | 09/08/2026 05:13 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 387273 [Mullvad wireguard.sys 0.10.1 IOCTL AdapterState الحرمان من الخدمة] |
|---|
| النقاط | 20 |
|---|