Executive brief
Kronosnet is a network protocol used to create secure communication channels between servers, often used in high-availability clusters. A flaw in how it handles fragmented data packets allows a remote attacker to send specially crafted traffic that can crash the service or cause system instability. This could lead to a denial-of-service condition, disrupting the reliability of server clusters and potentially impacting data availability.
Technical details
A vulnerability exists in the core network packet de-fragmentation engine of kronosnet (version 1.34 and earlier). The internal reassembly code fails to properly validate sequence numbers and offsets of incoming payload fragments. By transmitting malformed packets with overlapping or invalid sequence parameters, a network-based attacker can trigger an out-of-bounds write (CWE-787) or heap corruption. This occurs when the parser attempts to reassemble the payload using deceptive offsets, writing data beyond the allocated buffer limits. Successful exploitation can lead to a daemon crash (DoS) or potentially arbitrary code execution.
Affected products
- kronosnet kronosnet <= 1.34
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat OpenShift Container Platform 4
Timeline
- 2026-07-15: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-20: advisory: CVE published by NVD and Red Hat