提交 #866726: Mullvad wireguard.sys 0.10.1 Denial of Service

My name is Raul Mansurov. I am writing to report a security vulnerability discovered during independent research on mullvad-wireguard.sys version 0.10.1.

Severity: Medium (CVSS 3.1: 6.0 — AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)

Summary:
The AdapterState() IOCTL handler (0xB098C50C) calls ObfReferenceObject() on the caller's EPROCESS object when bringing the adapter UP, but never calls ObfDereferenceObject() when SocketInit() fails. This causes the kernel EPROCESS reference count to be permanently inflated on every failed UP call, leading to NonPagedPool memory exhaustion and eventual system crash (BSOD).

Confirmed impact (kernel debugger evidence):
- EPROCESS PointerCount inflated to 229,469 (normal: 3–10) — confirmed via WinDbg !object
- NonPagedPool grew +217 MB in 373 seconds (single thread)
- 14,300,000+ leaked references accumulated in ~6 minutes (8 threads)
- Kernel memory accounting internally inconsistent after sustained exploitation
- Estimated time to BSOD: ~25 min single-thread, ~3–5 min with 8 threads

Root cause (one line):
ObfDereferenceObject() is missing from the SocketInit() failure path in AdapterState().

Fix:
Add ObfDereferenceObject(SocketOwnerProcess) and clear SocketOwnerProcess to NULL in the failure path — mirroring the balanced teardown already present in the DOWN path.

Which updated by Mullvad wireguard protocol , but not CVE assigned yet . They confirmed it was a vulnerability

• 来源: ⚠️ https://drive.google.com/file/d/1LN68wxIx_2EI4IBVq13UlP4G1aqyz--x/view?usp=sharing
• 用户: Raulisr00t (UID 99240)
• 提交: 2026-06-23 20時45分 (2 月前)
• 管理: 2026-08-09 17時13分 (2 months later)
• 状态: 已接受
• VulDB条目: 387273 [Mullvad wireguard.sys 0.10.1 IOCTL AdapterState 拒绝服务]
• 积分: 20