CVE-2026-79977: auth in zephyrproject zephyr

The WireGuard VPN service in Zephyr's networking stack improperly updates the peer endpoint from unauthenticated transport-data messages when the receiver index is unknown. Specifically, in handle_transport_data(), if the 32-bit receiver index does not correspond to a valid session, the code schedules a handshake and copies the source address from the incoming UDP datagram into peer->endpoint without verifying the message's authenticity. Since the message is unauthenticated, this allows an attacker to supply an arbitrary address, redirecting subsequent handshake initiations, keepalives, and encrypted packets to an attacker-controlled endpoint. The legitimate peer never receives handshake initiations, preventing re-authentication and leaving the tunnel unusable on devices where the peer does not initiate handshakes. Additionally, an attacker can relay redirected initiations to the real peer, enabling traffic observation and selective packet dropping. The cryptography prevents decryption or forgery of tunnel content, so the impact is limited to availability loss and partial confidentiality exposure (traffic metadata). The fix removes endpoint learning from unauthenticated messages, requiring handshakes only to authenticated or configured endpoints, and drops messages when no valid endpoint is known. This vulnerability affects Zephyr versions >=4.4.0 and <=4.4.2. WireGuard support in Zephyr is experimental and disabled by default.

An attacker able to send UDP datagrams to the WireGuard port (51820) can spoof the peer endpoint address without authentication, redirecting traffic to an attacker-controlled address. This causes denial of service by making the tunnel persistently unusable if the peer does not initiate handshakes. The attacker can also perform limited traffic interception by relaying handshake initiations to the real peer, observing ciphertext and traffic metadata, and selectively dropping packets. The cryptographic protections of WireGuard prevent decryption or forgery of tunnel content, so there is no key compromise or plaintext exposure. The overall impact is high due to loss of availability and limited confidentiality exposure.

A fix is available that removes the unauthenticated endpoint update path. The patch ensures that handshake initiations are sent only to endpoints learned from authenticated messages or fall back to the configured endpoint, dropping messages when no valid endpoint is known. Users should upgrade Zephyr to a version later than 4.4.2 where this fix is applied. Since WireGuard support in Zephyr is experimental and disabled by default, enabling it should be done with caution. No other mitigation is indicated by the vendor advisory.