CVE-2025-24356
📋 TL;DR
CVE-2025-24356 is a UDP amplification vulnerability in fastd VPN daemon that allows attackers to spoof source addresses and trigger handshake packets, creating a 12-13x traffic amplification effect. This can be used to facilitate Distributed Denial of Service attacks against third parties. All internet-facing fastd instances running vulnerable versions are affected.
💻 Affected Systems
- fastd VPN daemon
📦 What is this software?
Fastd by Fastd Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could use vulnerable fastd instances as amplifiers in large-scale DDoS attacks, generating significant traffic volumes that could overwhelm target networks and services.
Likely Case
Internet-exposed fastd instances could be abused as DDoS amplifiers, potentially causing service disruption for targeted victims and consuming bandwidth/resources on the fastd host.
If Mitigated
With proper network controls and patching, the risk is limited to internal network reconnaissance or minimal impact if only internal-facing instances exist.
🎯 Exploit Status
Exploitation requires only sending crafted UDP packets to vulnerable instances. No authentication or special conditions needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v23
Vendor Advisory: https://github.com/neocturne/fastd/commit/1f233bee76b722c0b3f9024f2c39c72e9f7e5843
Restart Required: Yes
Instructions:
1. Stop fastd service. 2. Update to fastd v23 or later using your package manager or compile from source. 3. Restart fastd service.
🔧 Temporary Workarounds
Network Access Control
allRestrict UDP access to fastd ports (default 10000/udp) to trusted networks only using firewall rules.
iptables -A INPUT -p udp --dport 10000 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p udp --dport 10000 -j DROP
🧯 If You Can't Patch
- Implement strict firewall rules to only allow UDP access from trusted peer IP addresses
- Consider moving fastd instances behind VPN or private networks to prevent internet exposure
🔍 How to Verify
Check if Vulnerable:
Check fastd version with 'fastd --version' and verify it's below v23Check Version:
fastd --versionVerify Fix Applied:
Confirm version is v23 or higher with 'fastd --version' and test that fast reconnect still works for legitimate peers📡 Detection & Monitoring
Log Indicators:
- Unusual volume of handshake packets
- Connection attempts from unknown IP addresses
- High UDP traffic to/from fastd port
Network Indicators:
- UDP traffic amplification patterns
- Spoofed source IPs in UDP packets to fastd port
- Unusual outbound traffic from fastd instances
SIEM Query:
source_port:10000 AND protocol:UDP AND (bytes_out > bytes_in * 10)🔗 References
- https://github.com/neocturne/fastd/commit/1f233bee76b722c0b3f9024f2c39c72e9f7e5843
- https://github.com/neocturne/fastd/commit/3940150e801d0c91460491bec32cbcc5bbc89d5f
- https://github.com/neocturne/fastd/commit/5f63fcfc18ae9cad023fa463b152d5e14192b5a8
- https://github.com/neocturne/fastd/commit/9df7e516378441d2d17b89f9db5c27c8312d8f12
- https://github.com/neocturne/fastd/commit/c1a07b3f2b9066c3713c68547da700b85d60f4f7
- https://github.com/neocturne/fastd/commit/ce1b79b12dbfa796743b5f3a50789ade965b7023
- https://github.com/neocturne/fastd/commit/d03a0a17347efb5293e42fde7d982781e90f14ef
- https://github.com/neocturne/fastd/security/advisories/GHSA-pggg-vpfv-4rcv
