CVE-2018-1084: Integer Overflow
corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.
Other sources
Potential pre-authentication buffer overflow due to integer overflow in exec/totemcrypto.c:authenticatenss23() function can lead to denial of service or potentially to remote code execution.
Vulnerable code:
static int authenticatenss23 ( struct cryptoinstance instance, unsigned char buf, int buflen) { if (hashtonss[instance->cryptohashtype]) { unsigned char tmphash[hashlen[instance->cryptohashtype]]; int datalen = buflen - hashlen[instance->cryptohashtype];
if (calculatensshash(instance, buf, datalen, tmphash) < 0) { return -1; } ...
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1084?
CVE-2018-1084 is classified as a critical vulnerability due to its potential for pre-authentication buffer overflow.
How do I fix CVE-2018-1084?
To remediate CVE-2018-1084, upgrade corosync to version 2.4.4 or later.
Which versions of corosync are affected by CVE-2018-1084?
Versions of corosync prior to 2.4.4 are vulnerable to CVE-2018-1084.
What type of vulnerability is CVE-2018-1084?
CVE-2018-1084 is an integer overflow vulnerability in the corosync software.
What components of corosync are impacted by CVE-2018-1084?
The vulnerability is specifically found in the exec/totemcrypto.c file of corosync.