- Six months after a critical tun0 vulnerability in Android VPN clients was discovered, which allows excluded applications to bypass the tunnel and...
- The vulnerability manifests when an application, configured to be excluded from the VPN, binds a socket to the tun0 interface.
- Out of 28 analyzed VPN clients, only two took steps to verify connection ownership, yet both initially shared the same flaw: they...
AmneziaVPN Addresses Critical Tun0 Vulnerability, Other VPN Clients Still Exposed
Six months after a critical tun0 vulnerability in Android VPN clients was discovered, which allows excluded applications to bypass the tunnel and reveal the VPN server’s IP address, PROSTO24 provides an overview of the current situation. This issue requires no root access and is not mitigated by local proxy passwords.
Leak Mechanism and Verification
The vulnerability manifests when an application, configured to be excluded from the VPN, binds a socket to the tun0 interface. This allows it to transmit data through the VPN tunnel and obtain information about the VPN server’s address. To check for the leak, execute the command curl --interface tun0 https://ifconfig.me in Termux on an Android phone with an app excluded from the VPN. If the VPN server’s address is returned, the leak is present.
Market Response and AmneziaVPN’s Actions
Out of 28 analyzed VPN clients, only two took steps to verify connection ownership, yet both initially shared the same flaw: they permitted connections with an “unknown owner,” which includes excluded Android applications. One client promptly corrected the issue, while the other has not yet responded.
The AmneziaVPN team actively addressed this vulnerability (issue #2457). Although the packet inspection itself within AmneziaWG fit into a single line of code: if uidfilter.Supported && !device.tun.uidGate.AllowOutboundPacket(elem.packet, device) { continue }, the entire process required approximately 500 lines of Go code, a similar number of tests, a JNI bridge, and three rounds of review. AmneziaVPN developers note that the Android kernel passes such packets, and their policy treats “unknown owner” as a denial of traffic permission. During development, an error was found and corrected in their own bridge even after review. Testing on a phone with the filter activated showed 0 bypass attempts out of 6, whereas without the filter, all 6 attempts were successful.
Next Steps and Call for Collaboration
AmneziaVPN shares its experience to help other developers close similar vulnerabilities and invites the community to critically review their solution for further security enhancements.
The tun0 vulnerability highlights a critical oversight in how many Android VPN clients handle UID-based traffic routing, particularly for excluded applications. AmneziaVPN’s proactive fix, involving a robust packet inspection mechanism and a significant Go code implementation, sets a commendable standard. The core issue of the Android kernel passing ‘unknown owner’ packets necessitates a more stringent policy where such traffic is explicitly denied, rather than implicitly allowed. This deep dive into connection ownership verification is crucial, and other providers should swiftly adopt similar rigorous methodologies to prevent IP disclosure.