| शीर्षक | Mullvad wireguard.sys 0.10.1 Denial of Service |
|---|
| विवरण | My name is Raul Mansurov. I am writing to report a security vulnerability discovered during independent research on mullvad-wireguard.sys version 0.10.1.
Severity: Medium (CVSS 3.1: 6.0 — AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Summary:
The AdapterState() IOCTL handler (0xB098C50C) calls ObfReferenceObject() on the caller's EPROCESS object when bringing the adapter UP, but never calls ObfDereferenceObject() when SocketInit() fails. This causes the kernel EPROCESS reference count to be permanently inflated on every failed UP call, leading to NonPagedPool memory exhaustion and eventual system crash (BSOD).
Confirmed impact (kernel debugger evidence):
- EPROCESS PointerCount inflated to 229,469 (normal: 3–10) — confirmed via WinDbg !object
- NonPagedPool grew +217 MB in 373 seconds (single thread)
- 14,300,000+ leaked references accumulated in ~6 minutes (8 threads)
- Kernel memory accounting internally inconsistent after sustained exploitation
- Estimated time to BSOD: ~25 min single-thread, ~3–5 min with 8 threads
Root cause (one line):
ObfDereferenceObject() is missing from the SocketInit() failure path in AdapterState().
Fix:
Add ObfDereferenceObject(SocketOwnerProcess) and clear SocketOwnerProcess to NULL in the failure path — mirroring the balanced teardown already present in the DOWN path.
Which updated by Mullvad wireguard protocol , but not CVE assigned yet . They confirmed it was a vulnerability |
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/1LN68wxIx_2EI4IBVq13UlP4G1aqyz--x/view?usp=sharing |
|---|
| उपयोगकर्ता | Raulisr00t (UID 99240) |
|---|
| सबमिशन | 23/06/2026 08:45 PM (2 महीनों पहले) |
|---|
| संयम | 09/08/2026 05:13 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 387273 [Mullvad wireguard.sys 0.10.1 IOCTL AdapterState सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|