Description

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T10:17:13.187Z",
  "pubdate": "2026-09-04T10:17:13.187Z",
  "executiveSummary": "An integer overflow vulnerability exists in the Corosync cluster engine during the processing of membership commit token messages. The flaw specifically affects 32-bit system architectures where arithmetic operations on message length headers can be manipulated to trigger an out-of-bounds memory access. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service (DoS) by sending a specially crafted network packet to the Corosync daemon. Successful exploitation results in the abrupt termination of the daemon, leading to a cluster node failure. Given Corosync's role in cluster membership and communication, this disruption compromises high availability for dependent services. The vulnerability is architecture-specific, as 64-bit systems perform the calculation using 64-bit arithmetic, which prevents the overflow condition. Organizations utilizing 32-bit deployments of Corosync are at significant risk of targeted service disruption.",
  "technicalDetails": "The vulnerability resides within the Corosync message processing logic, specifically the validation routines responsible for handling membership commit tokens. When Corosync receives a network packet, it evaluates the message header to determine the expected payload length before allocating memory or copying data into a buffer. On 32-bit systems, the calculation of this length is performed using 32-bit registers. An attacker can supply a malicious packet with carefully crafted length values that, when subjected to arithmetic operations (such as addition or multiplication) within the validator, cause an integer overflow.\nThe overflow causes the resulting value to wrap around to a smaller integer than intended. Because the validation check relies on this corrupted, smaller value, the subsequent bounds-checking mechanism fails to identify that the packet payload is significantly larger than the allocated memory buffer. This leads to an out-of-bounds memory access during the deserialization or memory copy process. Specifically, the software attempts to write data beyond the boundaries of the heap-based buffer associated with the message processing stack.\nThe attack flow begins with the delivery of a crafted network packet over the cluster interconnect. Since Corosync processes membership and communication tokens at a low level, the attacker does not require prior authentication or elevated privileges within the cluster to deliver the malicious payload. Upon receiving the packet, the Corosync daemon executes the faulty length calculation. The resulting overflow triggers an out-of-bounds access, which, depending on the memory layout and the specific target architecture, results in a segmentation fault or an illegal memory access violation. This immediate crash causes the Corosync daemon to terminate, effectively removing the node from the cluster and triggering recovery events or causing a total service interruption if redundant nodes are similarly impacted.\nThis vulnerability is distinct from issues in 64-bit environments because the latter utilize 64-bit wide registers for the same arithmetic operations. The larger register width provides sufficient headroom to handle the maximum possible packet lengths defined by the protocol, preventing the wraparound that characterizes the integer overflow on 32-bit systems. Post-exploitation impact is limited to the denial of service of the specific daemon, as there is no evidence provided of arbitrary code execution or privilege escalation associated with this memory corruption event."
}