提出 #866726: Mullvad wireguard.sys 0.10.1 Denial of Service

My name is Raul Mansurov. I am writing to report a security vulnerability discovered during independent research on mullvad-wireguard.sys version 0.10.1.

Severity: Medium (CVSS 3.1: 6.0 — AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)

Summary:
The AdapterState() IOCTL handler (0xB098C50C) calls ObfReferenceObject() on the caller's EPROCESS object when bringing the adapter UP, but never calls ObfDereferenceObject() when SocketInit() fails. This causes the kernel EPROCESS reference count to be permanently inflated on every failed UP call, leading to NonPagedPool memory exhaustion and eventual system crash (BSOD).

Confirmed impact (kernel debugger evidence):
- EPROCESS PointerCount inflated to 229,469 (normal: 3–10) — confirmed via WinDbg !object
- NonPagedPool grew +217 MB in 373 seconds (single thread)
- 14,300,000+ leaked references accumulated in ~6 minutes (8 threads)
- Kernel memory accounting internally inconsistent after sustained exploitation
- Estimated time to BSOD: ~25 min single-thread, ~3–5 min with 8 threads

Root cause (one line):
ObfDereferenceObject() is missing from the SocketInit() failure path in AdapterState().

Fix:
Add ObfDereferenceObject(SocketOwnerProcess) and clear SocketOwnerProcess to NULL in the failure path — mirroring the balanced teardown already present in the DOWN path.

Which updated by Mullvad wireguard protocol , but not CVE assigned yet . They confirmed it was a vulnerability

• ソース: ⚠️ https://drive.google.com/file/d/1LN68wxIx_2EI4IBVq13UlP4G1aqyz--x/view?usp=sharing
• ユーザー: Raulisr00t (UID 99240)
• 送信: 2026年06月23日 20:45 (2 月 ago)
• モデレーション: 2026年08月09日 17:13 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 387273 [Mullvad wireguard.sys 0.10.1 IOCTL AdapterState サービス拒否]
• ポイント: 20