GHSA-q6v9-43v5-jv9q
CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| NuGet | CoreWCF.UnixDomainSocket | < 1.8.1 | 1.8.1 |
| NuGet | CoreWCF.UnixDomainSocket | >= 1.9.0, < 1.9.1 | 1.9.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Race condition in POSIX peer identity resolution may attribute one connection’s identity to another (getpwuid/getgrgid non-reentrant) and may crash the host process under contention.
### Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
### Workarounds
Restrict UDS filesystem permissions so that only trusted local users can connect to the socket path. The race still exists but the attacker pool is constrained.
References
External links from the advisory. They lead to third-party sites.