WireGuard Poly1305 Authentication Bypass in FreeBSD wg(4) Driver

Executive Summary

This vulnerability involves the wg(4) driver in FreeBSD's WireGuard implementation failing to verify the Poly1305 MAC after decrypting packets. WireGuard uses ChaCha20-Poly1305 for authenticated encryption, where Poly1305 ensures packet integrity. The driver delegated decryption to the OpenCrypto framework but did not check if the MAC validation succeeded, allowing it to accept packets with invalid authentication tags.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your FreeBSD system uses the affected wg(4) driver. Inspect kernel logs for WireGuard-related errors or failed MAC verifications. Use commands like 'dmesg | grep wg' or 'pciconf -l' to verify WireGuard driver presence. Monitor network traffic for unexpected packet modifications or replay attacks.

Useful 0 Not Useful 0

Impact Analysis

A remote attacker who can send UDP packets to a WireGuard endpoint and guess the receiver's replay window bounds can inject forged or modified transport data packets into the tunnel. Attackers who intercept WireGuard packets can modify ciphertext and authenticated data without detection by the receiver.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized data modification or injection into encrypted VPN tunnels. If attackers exploit this flaw, they may alter transmitted data without detection, potentially violating integrity requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade your FreeBSD system to a supported stable or release branch dated after July 29, 2026. Reboot the system after updating. Use pkg(8) or freebsd-update(8) for updates. If using source code, apply the provided patches. Ensure WireGuard endpoints are not exposed to untrusted networks during the update process.

Useful 0 Not Useful 0