- Vulnerability/
- USN-7478-1
USN-7478-1: Corosync vulnerability
First published: Mon May 05 2025(Updated: )
It was discovered that Corosync incorrectly handled certain large UDP packets. If encryption is disabled, or an attacker knows the encryption key, this issue could be used to cause Corosync to crash, resulting in a denial of service.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/corosync | <3.1.8-2ubuntu1.1 | 3.1.8-2ubuntu1.1 |
| Ubuntu | =24.10 | |
| All of | ||
| ubuntu/corosync | <3.1.7-1ubuntu3.1 | 3.1.7-1ubuntu3.1 |
| Ubuntu | =24.04 | |
| All of | ||
| ubuntu/corosync | <3.1.6-1ubuntu1.1 | 3.1.6-1ubuntu1.1 |
| Ubuntu | =22.04 | |
| All of | ||
| ubuntu/corosync | <3.0.3-2ubuntu2.2 | 3.0.3-2ubuntu2.2 |
| Ubuntu | =20.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2025-30472
- https://launchpad.net/ubuntu/+source/corosync/3.1.8-2ubuntu1.1
- https://launchpad.net/ubuntu/+source/corosync/3.1.7-1ubuntu3.1
- https://launchpad.net/ubuntu/+source/corosync/3.1.6-1ubuntu1.1
- https://launchpad.net/ubuntu/+source/corosync/3.0.3-2ubuntu2.2
- https://ubuntu.com/security/notices/USN-7478-1 (Advisory)
Frequently Asked Questions
What is the severity of USN-7478-1?
The severity of USN-7478-1 is high due to the potential for denial of service caused by large UDP packets.
How do I fix USN-7478-1?
To fix USN-7478-1, upgrade Corosync to version 3.1.8-2ubuntu1.1 or later for Ubuntu 24.10.
What versions of Corosync are affected by USN-7478-1?
USN-7478-1 affects versions of Corosync prior to 3.1.8-2ubuntu1.1, 3.1.7-1ubuntu3.1, 3.1.6-1ubuntu1.1, and 3.0.3-2ubuntu2.2.
What is the impact of the vulnerability in USN-7478-1?
The impact of the vulnerability in USN-7478-1 can lead to a crash of the Corosync service, resulting in a denial of service.
Is encryption required to exploit USN-7478-1?
Encryption is not required to exploit USN-7478-1, as an attacker can trigger the vulnerability if they know the encryption key.
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/title
- agent/references
- agent/source
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/first-publish-date
- agent/description
- agent/type
- agent/event
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu
- version/ubuntu/24.10
- version/ubuntu/24.04
- version/ubuntu/22.04
- version/ubuntu/20.04