Executive brief
CoreWCF is a library used to build communication services in .NET applications. A flaw in how it identifies users on Linux-based systems could allow one user's identity to be incorrectly attributed to another during simultaneous connections. This could lead to unauthorized access or cause the service to crash, impacting both security and system stability.
Technical details
A race condition exists in CoreWCF's UnixDomainSocket implementation when resolving POSIX peer identities. The library utilized non-reentrant libc functions (getpwuid and getgrgid) which return pointers to shared static buffers. Under high concurrency, these buffers could be overwritten by subsequent calls before the data was safely marshaled into managed code. This allows for identity spoofing between concurrent local connections or a process crash due to improper synchronization (CWE-362). The issue is resolved in versions 1.8.1 and 1.9.1 by migrating to the reentrant _r variants (getpwuid_r and getgrgid_r) with caller-supplied buffers.
Affected products
- CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1
Timeline
- 2026-07-08: advisory
- 2026-07-08: disclosed
References
- https://github.com/CoreWCF/CoreWCF/commit/a3d95ea4627b818995e92c7def4c016164cacfce
- https://github.com/CoreWCF/CoreWCF/commit/b0acb105589b455a095ea5ff49f5191e4eeff791
- https://github.com/CoreWCF/CoreWCF/commit/b4867547c94bb088568935d581a55dda18a621e1
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
- https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-q6v9-43v5-jv9q