Hello,

on behalf of Red Hat Product Security I'm writing to disclose a new vulnerability on Pacemaker software that upstream is making public today.

You can find the full report at the end of this message.

The patches for this vulnerability can be found at: https://github.com/clusterLabs/pacemaker/pull/4128

The CVE ID should be published to CVE.ORG later today. Please let me know if you have any questions.

Thanks,

==== CVE Report ====

CVE-2026-10649 CVSSv3.1: 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Severity rating (https://access.redhat.com/security/updates/classification/): Important

Description:

A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can cause the affected service to crash.

Acknowledgements: Found by AISLE in partnership with Red Hat

Notes: Although the original report mentions only the DoS as a consequence, it doesn't rule out further memory corruption or RCE (although unlikely). Because of this, we decided to adopt CI:L in CVSS as the attacker may be able to corrupt in-memory sensitive data or, in some cases, use this vulnerability to try to exfiltrate data, but the lack of total control over which data is corrupted seems very unlikely.

Original Report: Summary: Integer Overflow in Remote Message Decompression: crafted pre-auth compressed remote messages can wrap size calculations before allocation, leading to memory corruption and denial of service in the CIB remote listener. Requirements to exploit: Network reachability to a pacemaker-based CIB remote listener configured with remote-port or remote-tls-port, and the ability to send a crafted compressed remote message before authentication. The reproduction below demonstrates the fault on a 32-bit build with a memory sanitizer. Component affected: pacemaker-3.0.1-5.el10, lib/common/remote.c, pcmkremotemessagexml(), with the pre-auth call path through the CIB remote listener in daemons/based/basedremote.c

Vulnerability Details: In the remote message decompression path, attacker-controlled header values are used in size calculations before allocation: c if (header->payloadcompressed) { int rc = 0; unsigned int sizeu = 1 + header->payloaduncompressed; char uncompressed = pcmkassertalloc(1, header->payloadoffset + sizeu); ... rc = BZ2bzBuffToBuffDecompress(uncompressed + header->payloadoffset, &sizeu, remote->buffer + header->payloadoffset, header->payloadcompressed, 1, 0); payloadoffset, payloadcompressed, and payloaduncompressed are taken from the received remote message header, and there are no preceding bounds or consistency checks on these fields before sizeu and the allocation length are derived. A crafted message can therefore cause 1 + payloaduncompressed or payloadoffset + sizeu to wrap before allocation, leaving a small destination buffer while the decompressor is still asked to produce a much larger output region. This parsing occurs before client authentication on the CIB remote listener, so an unauthenticated client that can reach that listener can trigger the vulnerable path before cibremoteauth() completes. The available evidence supports a denial-of-service outcome through memory corruption and crash. It does not establish confidentiality, integrity, or code-execution impact, so those effects should be treated as unproven. Steps to reproduce: 1. Build and run a 32-bit pacemaker-based with ASan or another memory sanitizer, and enable remote-port or remote-tls-port. 2. Connect to the CIB remote listener and send one packet with payloadoffset = 0x00000028, payloaduncompressed = 0xFFFFFFC0, payloadcompressed = len(bz2payload) where bz2payload = bz2.compress(b"A"512 + b"\x00"), and sizetotal = payloadoffset + payloadcompressed. 3. Send the header and bz2payload as a single remote message. 4. Observe an out-of-bounds write or crash inside or immediately around BZ2bzBuffToBuffDecompress() from pcmkremotemessagexml() before authentication completes. Note: payloaduncompressed = UINT32MAX alone is not the best trigger. Values near UINT32MAX that make payloadoffset + (1 + payloaduncompressed) wrap are the more reliable case. Mitigation: Disable the CIB remote listener where it is not required. If it must remain enabled, restrict network access to trusted peers only. These steps reduce exposure but do not correct the underlying validation flaw.

Marco Benatto Red Hat Product Security secalert () redhat com for urgent response

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcrymdgetalgodlen(), it may allow an invalid HMAC to be accepted by the Booth server.

logblackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2.

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawkinvoke (built from tools/hawkinvoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawkinvoke, allowing escalation to root.

A security issue was discovered in pcs project. It is caused by incorrect permissions on a unix socket used for internal communication between pcs daemons. A privilege escalation could happen by obtaining authentication token for hacluster user. With the hacluster token, an attacker has complete control over the cluster managed by pcs. The bug was introduced in pcs version 0.10.5 by this bz [1]

[1] https://bugzilla.redhat.com/showbug.cgi?id=1783106

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.

A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.

stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.

An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawkremembermeid parameter in the loginfromcookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.

An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges.

Hi All,

Pacemaker is a high-availability cluster manager comprising multiple daemon processes that interact with each other and with user requests via IPC.

Users must either be root or in the haclient group to access Pacemaker daemon IPC.

One of these daemons, pacemaker-based, manages the Pacemaker configuration, known as the Cluster Information Base (CIB). Pacemaker may be built with support for Access Control Lists (ACLs) in which case pacemaker-based applies configured ACLs when processing user requests to read or write any part of the configuration.

When ACLs are not in use, any user in the haclient group has full access to the configuration, which effectively gives them the ability to run any code as root. (This is intentional, as the point of a cluster manager is to run arbitrary services.)

When ACLs are in use, users still must be in the haclient group, but their read and write access to various parts of the configuration is limited by configured ACLs.

The vulnerability is that users may use IPC communication with the various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration. This is not difficult; Pacemaker provides command-line tools to send many types of IPC requests.

More details along with patches is available at: https://bugzilla.redhat.com/showbug.cgi?id=1888191

-- Huzaifa Sidhpurwala / Red Hat Product Security

An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.

In fence-agents before 4.0.17 does not verify remote SSL certificates in the fenceciscoucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.

Pacemaker before 1.1.6 configure script creates temporary files insecurely

A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fencerhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member.

A flaw was found in libqb. Isecure handling of temporari files could be exploited by a local attacker to overwrite privileged system files.

Upstream issue:

https://github.com/ClusterLabs/libqb/issues/338

References:

https://bugzilla.redhat.com/showbug.cgi?id=1685297

A use-after-free defect was discovered in pacemaker that can possibly lead to unsolicited information disclosure in the log outputs.

A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS

A flaw was found in pacemaker. Insufficient verification of client-side authentication combined with other IPC weaknesses leads to local privilege escalation.

An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.

pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /runpcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.

A security issue was found in pcs deamon that permits an authorized user (with write permission in pcsd) to escalate privileges and write to any file in the system using a malicious REST call.

Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.

ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.

Session fixation vulnerability in pcsd in pcs before 0.9.157.

Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.

Franck Grosjean of Red Hat reports:

Description of problem: acl definitions are not enforced and could be bypassed by a user without write access to the cib

Version-Release number of selected component (if applicable): RedHat Enterprise Linux 6.6 pcs --version = 0.9.123 pacemakerd --version = Pacemaker 1.1.11

How reproducible: a user with a read-only role can assign any other existing roles to himself and then gain any kind of access from any role (rw access to the cib if this kind of role exist).

Steps to Reproduce: 1. create a role read-only pcs acl role create read-only description="Read only access" read xpath /cib 2. create a role admin pcs acl role create admin description="Admin access" write xpath /cib 3. create an account (local + pcs) 4. open a session with this roaccount account 5. add admin role to your account pcs acl role assign admin to rocluster 6. check new acl pushed as a read-only user pcs acl User: rocluster Roles: read-only admin Role: read-only Description: Read only access Permission: read xpath /cib (read-only-read) Role: admin Description: Admin access Permission: write xpath /cib (admin-write) 7. add/delete/modify anything

Actual results: obtain rw access to the cib

Expected results: must not be possible with read-only access to the cib to assign a role

Additional info:

Introduced in: https://github.com/ClusterLabs/pacemaker/commit/f242c1ef Fixed in: https://github.com/ClusterLabs/pacemaker/commit/84ac07c

A denial of service flaw was found in the way Pacemaker, an advanced, scalable high-availability cluster resource manager for Linux-HA (Heartbeat) and/or Corosync, performed authentication and processing of remote connections in certain circumstances. In general Pacemaker used a blocking socket (without a timeout) to wait for authentication credentials to arrive. When Pacemaker was configured to allow remote Cluster Information Base (CIB) cluster's configuration / cluster's resources management, a remote attacker could use this flaw to cause Pacemaker to block indefinitely (preventing it from serving another requests).

Important Note: In the default configuration of Pacemaker in Red Hat Enterprise Linux 6 the remote CIB management feature / functionality is turned off.