A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages,...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Ubuntu:16.04:LTScorosync |
All versions→ Not listed |
Not listed |
| Ubuntu:18.04:LTScorosync |
All versions→ Not listed |
Not listed |
| Ubuntu:20.04:LTScorosync |
All versions→ Not listed |
Not listed |
| Ubuntu:22.04:LTScorosync |
All versions→ Not listed |
Not listed |
| Ubuntu:24.04:LTScorosync |
All versions→ Not listed |
Not listed |
| Ubuntu:26.10corosync |
All versions→ Not listed |
Not listed |
| Ubuntu:26.04:LTScorosync |
All versions→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- report ubuntu.com
- report cve.org
- report bugzilla.redhat.com