CVE-2025-30472: Corosync Buffer Overflow Vulnerability

CVE-2025-30472 Overview

CVE-2025-30472 is a stack-based buffer overflow vulnerability affecting Corosync through version 3.1.9. The flaw exists in the orf_token_endian_convert function within exec/totemsrp.c and can be triggered via a large UDP packet when encryption is disabled or an attacker knows the encryption key. This vulnerability allows remote attackers to potentially achieve arbitrary code execution or cause denial of service on systems running vulnerable Corosync cluster communication infrastructure.

Critical Impact

Remote attackers can exploit this stack-based buffer overflow to compromise high-availability cluster nodes, potentially disrupting critical infrastructure services and gaining unauthorized access to cluster-connected systems.

Affected Products

• Corosync versions through 3.1.9
• Systems using Corosync for cluster communication with encryption disabled
• Cluster deployments where encryption keys may have been compromised

Discovery Timeline

• 2025-03-22 - CVE-2025-30472 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-30472

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The flaw resides in Corosync's token ring protocol implementation, specifically within the endian conversion routine that processes incoming network tokens. When processing oversized UDP packets, the orf_token_endian_convert function fails to properly validate the packet size before copying data to a stack-allocated buffer, leading to a classic stack-based buffer overflow condition.

Corosync is a group communication system used for implementing high availability within applications. It is commonly deployed in conjunction with Pacemaker for managing cluster resources in enterprise Linux environments. The vulnerability is particularly dangerous because it can be exploited remotely over the network without any prior authentication, assuming encryption is disabled or the attacker has obtained the encryption key.

Root Cause

The root cause of this vulnerability is insufficient bounds checking in the orf_token_endian_convert function located at line 4677 in exec/totemsrp.c. When processing incoming ORF tokens via UDP, the function does not adequately validate the size of incoming packet data against the destination buffer's capacity before performing memory operations. This allows an attacker to craft a malicious UDP packet that exceeds the expected buffer size, causing stack memory corruption.

Attack Vector

The attack is network-based and requires the attacker to send specially crafted UDP packets to a Corosync cluster node. The exploitation prerequisites include:

1. Network access to the Corosync communication port (typically UDP 5405)
2. Either encryption must be disabled on the cluster, OR the attacker must possess knowledge of the encryption key
3. The attacker must craft a UDP packet with a payload size large enough to trigger the buffer overflow in the endian conversion routine

The vulnerability manifests during the endian conversion process for ORF (Ordering and Reliable Fifo) tokens used in Corosync's totem single-ring ordering and membership protocol. The vulnerable code path can be found in the GitHub repository. Technical details and discussion are available in GitHub Issue #778.

Detection Methods for CVE-2025-30472

Indicators of Compromise

• Unusual UDP traffic to Corosync ports (default 5405) with abnormally large packet sizes
• Unexpected Corosync service crashes or restarts on cluster nodes
• Memory corruption errors or segmentation faults in Corosync logs
• Anomalous cluster membership changes or split-brain scenarios without clear cause

Detection Strategies

• Monitor Corosync service stability and log for unexpected crashes or restarts
• Implement network intrusion detection rules to identify oversized UDP packets targeting Corosync ports
• Deploy endpoint detection solutions capable of identifying stack buffer overflow exploitation attempts
• Audit cluster encryption configuration to ensure encryption is enabled with strong keys

Monitoring Recommendations

• Enable enhanced logging for Corosync daemon activity and cluster communications
• Configure alerts for Corosync service failures or unexpected restarts
• Monitor network traffic patterns for anomalous UDP packet sizes targeting cluster communication ports
• Implement SIEM correlation rules to detect potential exploitation attempts across cluster nodes

How to Mitigate CVE-2025-30472

Immediate Actions Required

• Verify Corosync encryption is enabled on all cluster nodes and encryption keys are securely managed
• Restrict network access to Corosync communication ports using firewall rules
• Update Corosync to a patched version as soon as one becomes available
• Monitor the Corosync project and GitHub Issue #778 for security updates

Patch Information

Administrators should monitor the official Corosync project and distribution security advisories for patch availability. Debian users can refer to the Debian LTS Announcement for distribution-specific updates. Ensure all cluster nodes are updated simultaneously to prevent compatibility issues.

Workarounds

• Enable Corosync encryption with a strong, randomly generated key to prevent exploitation by attackers without key knowledge
• Implement strict network segmentation to limit access to Corosync cluster communication ports
• Use firewall rules to allow only trusted cluster node IP addresses to communicate on Corosync ports
• Consider deploying intrusion prevention systems (IPS) capable of blocking oversized UDP packets

# Verify Corosync encryption is enabled
grep -E "crypto_cipher|crypto_hash" /etc/corosync/corosync.conf

# Example firewall rule to restrict Corosync port access (iptables)
iptables -A INPUT -p udp --dport 5405 -s <trusted_cluster_subnet> -j ACCEPT
iptables -A INPUT -p udp --dport 5405 -j DROP