Moderate Vulnerability in Corosync Package: Stack Buffer Overflow Risk
Summary
RLSA-2025:7478: Moderate: corosync security update. Affects corosync versions < 0:3.1.9-1.el10_0.1. Fixed in 0:3.1.9-1.el10_0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Corosync is a cluster engine that provides a framework for high availability and clustering in Rocky Linux environments. It facilitates communication between nodes in a cluster, ensuring data consistency and reliability. The corosync package is essential for applications that require coordinated operations across multiple servers. However, a recently identified vulnerability poses a significant risk to its integrity and security.
Vulnerability Detail
The vulnerability, identified as CVE-2025-30472, is a stack buffer overflow that occurs in the 'orf_token_endian_convert' function of the Corosync package. This flaw can be exploited by an attacker to execute arbitrary code, potentially leading to unauthorized access or denial of service. The vulnerability arises from improper handling of data, which allows for excessive data to be written to a buffer, exceeding its allocated size. The CVSS score for this vulnerability is 6.6, indicating a moderate level of risk.
How To Fix
Minimum fixed version
0:3.1.9-1.el10_0.1
This is the first release that contains the fix.
sudo dnf update corosyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the Corosync service or implement network security controls to mitigate potential exploitation until the package is updated.
Conclusion
The Corosync package in Rocky Linux has a moderate vulnerability (CVE-2025-30472) that poses risks of stack buffer overflow. Users are advised to update to the patched version to mitigate these risks. For those unable to update immediately, temporary workarounds can be employed to enhance security.
See every vulnerability recorded for corosync →
FAQ
CVE-2025-30472 is a stack buffer overflow vulnerability in the Corosync package that can allow attackers to execute arbitrary code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized access, data corruption, or denial of service in affected systems.
Yes, a patch is available in the form of an updated package version 0:3.1.9-1.el10_0.1.
If immediate updates are not possible, consider implementing network security measures to restrict access to the Corosync service.
Related vulnerabilities
Recent vulnerabilities recorded for corosync.
