Corosync vulnerabilities

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check can be bypassed on 32-bit systems due to an integer overflow, allowing a crafted network packet to trigger out-of-bounds memory access and crash the Corosync daemon, resulting in denial of service for the affected cluster node. The overflow does not occur on 64-bit systems.

A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. Lack of runtime bounds check in release builds allows a network-adjacent attacker to cause a heap overflow with controlled data, potentially crashing the Corosync daemon and causing denial of service to the entire cluster.

A flaw was found in Corosync related to an integer overflow in join message sanity validation. This allows a remote, unauthenticated attacker to send crafted UDP packets, potentially causing the service to crash and leading to a denial of service.

A flaw was found in Corosync that allows a remote unauthenticated attacker to exploit a wrong return value vulnerability in the membership commit token sanity check. By sending a specially crafted UDP packet, the attacker can lead to an out-of-bounds read, resulting in a denial of service (DoS) and potentially disclosing limited memory contents.