CVE-2025-30472
📋 TL;DR
Corosync versions through 3.1.9 contain a stack-based buffer overflow vulnerability in the orf_token_endian_convert function when processing large UDP packets. This allows remote attackers to execute arbitrary code or crash the service if encryption is disabled or they know the encryption key. Systems using Corosync for cluster communication without proper encryption are primarily affected.
💻 Affected Systems
- Corosync
📦 What is this software?
Corosync by Corosync
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges leading to complete cluster compromise, data exfiltration, and lateral movement.
Likely Case
Service crash causing cluster failure and denial of service, potentially disrupting critical infrastructure.
If Mitigated
Limited impact if encryption is properly enabled with strong keys, though denial of service may still be possible.
🎯 Exploit Status
Exploitation requires sending specially crafted UDP packets to Corosync ports (typically 5404-5406). No authentication needed if encryption is disabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.10 or later
Vendor Advisory: https://github.com/corosync/corosync/issues/778
Restart Required: Yes
Instructions:
1. Check current version with 'corosync -v'. 2. Update via package manager: 'apt update && apt upgrade corosync' (Debian/Ubuntu) or 'yum update corosync' (RHEL/CentOS). 3. Restart Corosync service: 'systemctl restart corosync'. 4. Verify cluster health.
🔧 Temporary Workarounds
Enable Encryption
linuxEnsure Corosync encryption is enabled with strong keys to prevent exploitation
Edit /etc/corosync/corosync.conf
Set crypto_cipher: aes256
Set crypto_hash: sha256
Restart corosync: systemctl restart corosync
Network Segmentation
linuxRestrict access to Corosync ports using firewall rules
iptables -A INPUT -p udp --dport 5404:5406 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p udp --dport 5404:5406 -j DROP
🧯 If You Can't Patch
- Enable strong encryption in Corosync configuration immediately
- Implement strict network controls to limit UDP access to Corosync ports from trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check Corosync version: 'corosync -v | grep version' and verify if ≤ 3.1.9. Check encryption status in /etc/corosync/corosync.conf for crypto_cipher setting.Check Version:
corosync -v | grep versionVerify Fix Applied:
Verify version is 3.1.10 or later with 'corosync -v'. Confirm cluster is functioning with 'corosync-cfgtool -s'.📡 Detection & Monitoring
Log Indicators:
- Corosync service crashes in system logs
- Unexpected segmentation faults in Corosync logs
- Cluster membership changes without explanation
Network Indicators:
- Large UDP packets (> typical size) to Corosync ports 5404-5406
- Unusual traffic patterns to cluster nodes
SIEM Query:
source="corosync.log" AND ("segmentation fault" OR "buffer overflow" OR "SIGSEGV")