Executive brief
Corosync is cluster management software used to coordinate High Availability deployments across multiple servers. An integer overflow vulnerability in the message length validation on 32-bit systems allows a malicious network packet to crash the Corosync daemon, causing the affected cluster node to become unavailable. While 64-bit systems are unaffected, this can disrupt cluster operations for affected 32-bit deployments.
Technical details
An integer overflow in the check_memb_commit_token_sanity function bypasses length validation for membership commit token messages on 32-bit systems. The vulnerability arises from a 32-bit integer multiplication in the message length calculation that overflows, allowing an attacker to craft a network packet that passes validation but triggers an out-of-bounds memory access. The attack is network-adjacent (requires access to cluster communication network, typically UDP ports 5405-5412) and requires no authentication. The overflow does not occur on 64-bit systems due to C integer-promotion rules that cause the calculation to be evaluated in 64-bit arithmetic. Clusters with message authentication enabled (the default in Red Hat's HA configuration) have significantly reduced risk. A patch is expected from upstream Corosync.
Affected products
- Red Hat Enterprise Linux High Availability Add-On 7 through 10
- Corosync Corosync unspecified
Timeline
- 2026-09-04: disclosed