Fedora Account System
Red Hat Associate
Red Hat Customer
Corosync is a group communication system providing reliable ordered messaging and membership services, and is the communication layer underlying Pacemaker HA clusters (RHEL High Availability Add-On). In exec/totempg.c, the totempg_deliver_fn function reassembles fragmented multicast messages into a fixed-size per-node assembly buffer (struct assembly, data[MESSAGE_SIZE_MAX + KNET_MAX_PACKET_SIZE], ~1.06 MB on normal builds, ~128 KB on small-memory-footprint builds). The only bounds check before the memcpy at line 663 is an assert() at line 662, which is compiled out in release builds (-DNDEBUG). assembly->index grows unboundedly at line 737 for each continuation fragment with no upper-bound check. After 17-18 fragments on normal builds (3 fragments on small-memory-footprint builds), the memcpy writes attacker-controlled data past the end of the heap buffer. Verified via an ASan-instrumented standalone harness reproducing the exact buffer layout and memcpy/index logic: after 17 fragments of 65,481 bytes each, assembly->index reached 1,113,177 (buffer capacity 1,114,112); fragment 18 triggered a confirmed heap-buffer-overflow WRITE of 65,481 bytes, 64,546 bytes past the buffer end. Present in corosync v3.1.10 (latest upstream release) and main HEAD (commit 65235a8); no upstream fix exists for this bug. Reported by Tristan Madani (Talence Security) via PSIRTSUPT-22352.
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:67880 https://access.redhat.com/errata/RHSA-2026:67880
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:67872 https://access.redhat.com/errata/RHSA-2026:67872
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:67878 https://access.redhat.com/errata/RHSA-2026:67878
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:67881 https://access.redhat.com/errata/RHSA-2026:67881
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:67873 https://access.redhat.com/errata/RHSA-2026:67873
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:67879 https://access.redhat.com/errata/RHSA-2026:67879
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:68574 https://access.redhat.com/errata/RHSA-2026:68574
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:69280 https://access.redhat.com/errata/RHSA-2026:69280
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:69279 https://access.redhat.com/errata/RHSA-2026:69279
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:69278 https://access.redhat.com/errata/RHSA-2026:69278
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:69277 https://access.redhat.com/errata/RHSA-2026:69277