Description

A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T09:17:11.357Z",
  "pubdate": "2026-09-04T09:17:11.357Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists within the Totem Process Group (totempg) component of the Corosync cluster engine. The flaw resides in the message reassembly logic, specifically when handling fragmented multicast packets. Due to the absence of runtime bounds checking in release builds, the application fails to validate the size of incoming data against the allocated heap buffer.\nThis vulnerability allows a network-adjacent attacker—one with the ability to inject crafted multicast traffic into the cluster—to trigger an out-of-bounds write. Successful exploitation results in the immediate termination of the corosync daemon, leading to a cluster-wide Denial of Service (DoS). Beyond service disruption, the vulnerability may facilitate arbitrary code execution if the attacker achieves sufficient control over heap metadata or object pointers during the overflow process.\nThe flaw is particularly severe in environments where multicast traffic is not strictly isolated or authenticated, as it provides an entry point for remote attackers to compromise the availability and integrity of the cluster management layer. No specialized authentication is required to send the malicious multicast messages, significantly lowering the barrier for exploitation.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of memory management during the reassembly of fragmented messages within the totempg protocol stack. In the Corosync Totem protocol, large messages are decomposed into smaller fragments for multicast transmission. The receiving node is responsible for aggregating these fragments back into a contiguous buffer before passing the payload to the upper layers of the stack.\nDuring this reassembly process, the totempg component allocates a heap buffer to accommodate the reconstructed data. However, the logic responsible for calculating the total expected message size and comparing it against the allocated destination buffer lacks mandatory runtime bounds validation in release build configurations. When a malicious actor crafts a sequence of fragmented multicast messages that exceed the initial allocation size, the reassembly function continues to write incoming data fragments beyond the designated heap boundary.\nThe exploitation flow begins with the attacker injecting a series of specially crafted multicast frames onto the cluster's network interface. These frames are designed to force the target node's totempg component to initialize a reassembly operation for an oversized message. As subsequent fragments arrive, the application blindly appends these fragments to the heap memory. Because the code fails to verify if the accumulated length surpasses the heap chunk size, a heap-based buffer overflow occurs.\nFrom an exploitation perspective, the impact is two-fold. First, by corrupting adjacent heap chunks, an attacker can overwrite heap management structures or critical application pointers. In a standard DoS scenario, the memory corruption triggers a segmentation fault or a memory integrity violation, causing the corosync daemon to crash and forcing the cluster to reconfigure or failover unexpectedly. Second, if the attacker can influence the heap layout—often referred to as heap grooming or spraying—the overflow may be leveraged to redirect execution flow by overwriting function pointers stored in heap-allocated structures, potentially leading to arbitrary code execution with the privileges of the corosync process, which often runs with high system privileges.\nThe vulnerability is exposed to any network-adjacent entity capable of multicast communication within the cluster segment. As the protocol does not implicitly require authentication for the ingestion of these multicast fragments, the attack vector remains highly accessible in unprotected or flat network topologies."
}