REDHAT-BUG-2354229: Buffer Overflow

Q: Under what conditions can an attacker exploit this issue?

The attacker must be able to send a large UDP packet to Corosync and either encryption must be disabled or the attacker must know the encryption key.

Q: Are deployments using Corosync encryption protected?

Encryption prevents the described attack only when it is enabled and the encryption key is not known to the attacker. Deployments with disabled encryption remain exposed to large UDP packets.

Q: What can be done while a fix is not yet available?

Enable Corosync encryption and protect its encryption key. Restricting access to the UDP network used by Corosync can also limit who can send the crafted packet required for exploitation.

Published Mar 22, 2025

Updated

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet.

Affected Software

1 affected component

corosync corosync<=3.1.9

Event History

Mar 22, 2025

Data Sourced

via Red Hat·02:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Under what conditions can an attacker exploit this issue?

The attacker must be able to send a large UDP packet to Corosync and either encryption must be disabled or the attacker must know the encryption key.

Are deployments using Corosync encryption protected?

Encryption prevents the described attack only when it is enabled and the encryption key is not known to the attacker. Deployments with disabled encryption remain exposed to large UDP packets.

What can be done while a fix is not yet available?

Enable Corosync encryption and protect its encryption key. Restricting access to the UDP network used by Corosync can also limit who can send the crafted packet required for exploitation.

REDHAT-BUG-2354229: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Under what conditions can an attacker exploit this issue?

Are deployments using Corosync encryption protected?

What can be done while a fix is not yet available?

Company

Resources

Contact

Frequently Asked Questions

Under what conditions can an attacker exploit this issue?

Are deployments using Corosync encryption protected?

What can be done while a fix is not yet available?