CVE-2024-42247

What it actually does

The wireguard allowedips implementation performs 64-bit loads of IPv6 addresses without ensuring alignment, triggering unaligned access warnings and potential faults on architectures such as parisc when wg_allowedips_insert_v6 executes swap_endian().

Why it matters to the business

Systems running WireGuard on affected hardware may experience repeated kernel warnings that complicate troubleshooting, increase log volume, and in rare cases lead to instability; the large number of downstream Linux distributions amplifies the scope of required updates.

How an attack unfolds

An attacker with local access crafts or triggers insertion of an IPv6 route into the allowedips trie; on parisc the resulting unaligned memory reference in swap_endian() produces a kernel warning. No remote code execution or privilege escalation path has been demonstrated.

How to fix it

Update the Linux kernel to a version containing commit ae630de24efb123d7199a43256396d7758f4cb75 or later; AlmaLinux 8 users should install parted-3.2-39.el8 (or newer) which carries the corrected WireGuard module. Reboot after package installation.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking /proc/version or the package changelog for ae630de24efb; attempt to insert an IPv6 allowedips entry on parisc hardware and verify absence of unaligned-access warnings in dmesg.

Typical attack path

1. Obtain local access to a parisc Linux system running WireGuard
2. Trigger insertion of a 128-bit IPv6 address into the allowedips structure
3. Observe kernel unaligned-access warnings emitted from wg_allowedips_insert_v6

How to detect it

Search kernel logs and dmesg for the strings "unaligned access" together with "wg_allowedips_insert_v6"; correlate with WireGuard interface configuration changes or route insertions on parisc platforms.

• unaligned access to 0x.* in wg_allowedips_insert_v6
• wg_allowedips_insert_v6+0x2c/0x80
• iir 0xf3010df

What your security team should do

• Prioritize kernel updates on all parisc systems that use WireGuard
• Monitor dmesg and kernel logs for unaligned access warnings referencing wg_allowedips_insert_v6
• Apply the fixed packages (parted 3.2-39.el8 or kernel commit ae630de) within normal change windows given the low EPSS and non-KEV status