Bug 2500849 (CVE-2026-15811)

Summary: CVE-2026-15811 kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changes
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: fdinitto, rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after the associated structures are freed. A local attacker capable of leveraging memory disclosure techniques could exploit this flaw to retrieve the active encryption key, allowing them to decrypt cluster network communications or inject malicious packets to cause severe high-availability cluster instability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2500850    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-15 10:28:54 UTC 
Vulnerability Reference: A flaw was found in kronosnet where it fails to properly sanitize sensitive memory locations following cryptographic configuration adjustments, potentially exposing encryption keys to local attackers.

Component / Vulnerable Part: kronosnet -> Core cryptographic configuration and memory management subsystems (https://github.com/kronosnet/kronosnet/).

Technical Analysis & Root Cause: When cryptographic configuration changes are performed within kronosnet, the internal memory structures holding active encryption keys are freed or reallocated. However, the runtime implementation lacks an explicit memory-wiping routine (such as memset_s or equivalent secure clearing operations) before releasing these blocks back to the system heap. As a result, the raw cryptographic key material remains resident in unallocated memory space. A local attacker with the capability to exploit secondary memory disclosure vulnerabilities or inspect uninitialized heap segments can recover the active encryption key.

Impact: With the recovered cryptographic key, a local attacker can decrypt network communications handled by the kronosnet framework or inject unauthorized packets into the cluster traffic, leading to data exposure and cluster or system instability.