Bug 2500864

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Vulnerability Reference: A flaw was found in kronosnet's network packet processing layer, where improper validation during fragment reassembly can trigger memory corruption or out-of-bounds memory access.

Component / Vulnerable Part: kronosnet -> Core network packet de-fragmentation engine (https://github.com/kronosnet/kronosnet/).

Technical Analysis & Root Cause: When kronosnet reassembles fragmented network payloads, it tracks individual chunks using sequence numbers. The defragmentation subsystem lacks rigid boundary and validation logic when ordering these incoming fragments. A network adversary can craft and inject fragments with overlapping, out-of-order, or invalid sequence numbers. When the parser tries to reassemble the payload using these deceptive offsets, it writes data beyond the limits of the allocated reassembly buffer, leading to memory corruption or an out-of-bounds memory access condition.

Impact: A remote attacker can weaponize this structural flaw to deliberately destabilize or crash the kronosnet process (Denial of Service). Depending on the heap layout and data overwriting context, it could potentially be leveraged for arbitrary code execution within the daemon context.