In the Linux kernel, the following vulnerability has been resolved:
wireguard: receive: annotate data-race around receiving_counter.counter
Syzkaller with KCSAN identified a data-race issue when accessing keypair->receivingcounter.counter. Use READONCE() and WRITE_ONCE() annotations to mark the data race as intentional.
BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll
write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0:
counter_validate drivers/net/wireguard/receive.c:321 [inline]
wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461
__napi_poll+0x60/0x3b0 net/core/dev.c:6536
napi_poll net/core/dev.c:6605 [inline]
net_rx_action+0x32b/0x750 net/core/dev.c:6738
__do_softirq+0xc4/0x279 kernel/softirq.c:553
do_softirq+0x5e/0x90 kernel/softirq.c:454
__local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
_raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
spin_unlock_bh include/linux/spinlock.h:396 [inline]
ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline]
wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499
process_one_work kernel/workqueue.c:2633 [inline]
...
read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1:
decrypt_packet drivers/net/wireguard/receive.c:252 [inline]
wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501
process_one_work kernel/workqueue.c:2633 [inline]
process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706
worker_thread+0x525/0x730 kernel/workqueue.c:2787
...
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "decrypt_packet"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdf16de078a97bf14bb8ee2b8d47cc3d3ead09ed",
"digest": {
"length": 1130.0,
"function_hash": "125843055543996928556635338799989460438"
},
"id": "CVE-2024-26861-17c700d1"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "counter_validate"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bba045dc4d996d03dce6fe45726e78a1a1f6d4c3",
"digest": {
"length": 914.0,
"function_hash": "40820621732447990003210890569155695381"
},
"id": "CVE-2024-26861-18ef6484"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "wg_packet_rx_poll"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdf16de078a97bf14bb8ee2b8d47cc3d3ead09ed",
"digest": {
"length": 1113.0,
"function_hash": "258035064515200052653794773849561238437"
},
"id": "CVE-2024-26861-1b800ed0"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "decrypt_packet"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78739d72f16b2d7d549f713f1dfebd678d32484b",
"digest": {
"length": 1130.0,
"function_hash": "125843055543996928556635338799989460438"
},
"id": "CVE-2024-26861-1bddaf9c"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "decrypt_packet"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bba045dc4d996d03dce6fe45726e78a1a1f6d4c3",
"digest": {
"length": 1116.0,
"function_hash": "202475061062088086730268663848885794637"
},
"id": "CVE-2024-26861-2340c11b"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a83b220c83e3c326513269afbf69ae6fc65cce",
"digest": {
"line_hashes": [
"198006484857042154362743907342294575940",
"157619942979222557030041963212109889095",
"27254722682379162549521326495429752138",
"72326140785370987298950594123658820569",
"91745965853925534257454109186260315570",
"53133865685232592610774771715737076305",
"187923116420473318573656797360623241936",
"53203232161847649602552082850200026039",
"230000471930849801025832191539837646477",
"332187210048988356481720296364269649408",
"263397117513954335938701142263607764506",
"245590400405283411305477987966908745044"
],
"threshold": 0.9
},
"id": "CVE-2024-26861-2907b968"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "counter_validate"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a83b220c83e3c326513269afbf69ae6fc65cce",
"digest": {
"length": 914.0,
"function_hash": "40820621732447990003210890569155695381"
},
"id": "CVE-2024-26861-2f826a1a"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "counter_validate"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f94da807fe1668b9830f0eefbbf7e887b0a7bc6",
"digest": {
"length": 914.0,
"function_hash": "40820621732447990003210890569155695381"
},
"id": "CVE-2024-26861-4012da4a"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "wg_packet_rx_poll"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78739d72f16b2d7d549f713f1dfebd678d32484b",
"digest": {
"length": 1113.0,
"function_hash": "258035064515200052653794773849561238437"
},
"id": "CVE-2024-26861-59e76393"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "wg_packet_rx_poll"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bba045dc4d996d03dce6fe45726e78a1a1f6d4c3",
"digest": {
"length": 1113.0,
"function_hash": "258035064515200052653794773849561238437"
},
"id": "CVE-2024-26861-5fc695e0"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "counter_validate"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdf16de078a97bf14bb8ee2b8d47cc3d3ead09ed",
"digest": {
"length": 914.0,
"function_hash": "40820621732447990003210890569155695381"
},
"id": "CVE-2024-26861-62f51fe3"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bba045dc4d996d03dce6fe45726e78a1a1f6d4c3",
"digest": {
"line_hashes": [
"198006484857042154362743907342294575940",
"157619942979222557030041963212109889095",
"27254722682379162549521326495429752138",
"72326140785370987298950594123658820569",
"91745965853925534257454109186260315570",
"53133865685232592610774771715737076305",
"187923116420473318573656797360623241936",
"53203232161847649602552082850200026039",
"230000471930849801025832191539837646477",
"332187210048988356481720296364269649408",
"263397117513954335938701142263607764506",
"245590400405283411305477987966908745044"
],
"threshold": 0.9
},
"id": "CVE-2024-26861-6d628a3a"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "decrypt_packet"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f87884e0dffd61b47e58bc6e1e2f6843c212b0cc",
"digest": {
"length": 1130.0,
"function_hash": "125843055543996928556635338799989460438"
},
"id": "CVE-2024-26861-6e2fed36"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdf16de078a97bf14bb8ee2b8d47cc3d3ead09ed",
"digest": {
"line_hashes": [
"198006484857042154362743907342294575940",
"157619942979222557030041963212109889095",
"27254722682379162549521326495429752138",
"72326140785370987298950594123658820569",
"91745965853925534257454109186260315570",
"53133865685232592610774771715737076305",
"187923116420473318573656797360623241936",
"53203232161847649602552082850200026039",
"230000471930849801025832191539837646477",
"332187210048988356481720296364269649408",
"263397117513954335938701142263607764506",
"245590400405283411305477987966908745044"
],
"threshold": 0.9
},
"id": "CVE-2024-26861-705227f4"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f94da807fe1668b9830f0eefbbf7e887b0a7bc6",
"digest": {
"line_hashes": [
"198006484857042154362743907342294575940",
"157619942979222557030041963212109889095",
"27254722682379162549521326495429752138",
"72326140785370987298950594123658820569",
"91745965853925534257454109186260315570",
"53133865685232592610774771715737076305",
"187923116420473318573656797360623241936",
"53203232161847649602552082850200026039",
"230000471930849801025832191539837646477",
"332187210048988356481720296364269649408",
"263397117513954335938701142263607764506",
"245590400405283411305477987966908745044"
],
"threshold": 0.9
},
"id": "CVE-2024-26861-709b7921"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "wg_packet_rx_poll"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f94da807fe1668b9830f0eefbbf7e887b0a7bc6",
"digest": {
"length": 1113.0,
"function_hash": "258035064515200052653794773849561238437"
},
"id": "CVE-2024-26861-923f649f"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "wg_packet_rx_poll"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f87884e0dffd61b47e58bc6e1e2f6843c212b0cc",
"digest": {
"length": 1113.0,
"function_hash": "258035064515200052653794773849561238437"
},
"id": "CVE-2024-26861-948a16ae"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "counter_validate"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78739d72f16b2d7d549f713f1dfebd678d32484b",
"digest": {
"length": 914.0,
"function_hash": "40820621732447990003210890569155695381"
},
"id": "CVE-2024-26861-9afcf9bf"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "counter_validate"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f87884e0dffd61b47e58bc6e1e2f6843c212b0cc",
"digest": {
"length": 914.0,
"function_hash": "40820621732447990003210890569155695381"
},
"id": "CVE-2024-26861-9cb0c078"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "decrypt_packet"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f94da807fe1668b9830f0eefbbf7e887b0a7bc6",
"digest": {
"length": 1130.0,
"function_hash": "125843055543996928556635338799989460438"
},
"id": "CVE-2024-26861-b9d4393c"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "decrypt_packet"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a83b220c83e3c326513269afbf69ae6fc65cce",
"digest": {
"length": 1130.0,
"function_hash": "125843055543996928556635338799989460438"
},
"id": "CVE-2024-26861-bd984675"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78739d72f16b2d7d549f713f1dfebd678d32484b",
"digest": {
"line_hashes": [
"198006484857042154362743907342294575940",
"157619942979222557030041963212109889095",
"27254722682379162549521326495429752138",
"72326140785370987298950594123658820569",
"91745965853925534257454109186260315570",
"53133865685232592610774771715737076305",
"187923116420473318573656797360623241936",
"53203232161847649602552082850200026039",
"230000471930849801025832191539837646477",
"332187210048988356481720296364269649408",
"263397117513954335938701142263607764506",
"245590400405283411305477987966908745044"
],
"threshold": 0.9
},
"id": "CVE-2024-26861-d926379b"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f87884e0dffd61b47e58bc6e1e2f6843c212b0cc",
"digest": {
"line_hashes": [
"198006484857042154362743907342294575940",
"157619942979222557030041963212109889095",
"27254722682379162549521326495429752138",
"72326140785370987298950594123658820569",
"91745965853925534257454109186260315570",
"53133865685232592610774771715737076305",
"187923116420473318573656797360623241936",
"53203232161847649602552082850200026039",
"230000471930849801025832191539837646477",
"332187210048988356481720296364269649408",
"263397117513954335938701142263607764506",
"245590400405283411305477987966908745044"
],
"threshold": 0.9
},
"id": "CVE-2024-26861-d981c462"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/net/wireguard/receive.c",
"function": "wg_packet_rx_poll"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45a83b220c83e3c326513269afbf69ae6fc65cce",
"digest": {
"length": 1113.0,
"function_hash": "258035064515200052653794773849561238437"
},
"id": "CVE-2024-26861-eb0e5c8c"
}
]