Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Corosync is a group communication system providing reliable ordered messaging and membership services, and is the communication layer underlying Pacemaker HA clusters (RHEL High Availability Add-On). In exec/totempg.c, the totempg_deliver_fn function reassembles fragmented multicast messages into a fixed-size per-node assembly buffer (struct assembly, data[MESSAGE_SIZE_MAX + KNET_MAX_PACKET_SIZE], ~1.06 MB on normal builds, ~128 KB on small-memory-footprint builds). The only bounds check before the memcpy at line 663 is an assert() at line 662, which is compiled out in release builds (-DNDEBUG). assembly->index grows unboundedly at line 737 for each continuation fragment with no upper-bound check. After 17-18 fragments on normal builds (3 fragments on small-memory-footprint builds), the memcpy writes attacker-controlled data past the end of the heap buffer. Verified via an ASan-instrumented standalone harness reproducing the exact buffer layout and memcpy/index logic: after 17 fragments of 65,481 bytes each, assembly->index reached 1,113,177 (buffer capacity 1,114,112); fragment 18 triggered a confirmed heap-buffer-overflow WRITE of 65,481 bytes, 64,546 bytes past the buffer end. Present in corosync v3.1.10 (latest upstream release) and main HEAD (commit 65235a8); no upstream fix exists for this bug. Reported by Tristan Madani (Talence Security) via PSIRTSUPT-22352.
FEDORA-2026-ef5ca6ecf7 (corosync-3.1.10-8.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-ef5ca6ecf7
FEDORA-2026-e97124c200 (corosync-3.1.10-6.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-e97124c200
FEDORA-2026-c0427570d6 (corosync-3.1.10-3.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-c0427570d6
FEDORA-2026-e97124c200 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-e97124c200` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-e97124c200 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-c0427570d6 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-c0427570d6` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-c0427570d6 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-ef5ca6ecf7 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-ef5ca6ecf7` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-ef5ca6ecf7 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-e97124c200 (corosync-3.1.10-6.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-c0427570d6 (corosync-3.1.10-3.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.