CoreWCF UnixDomainSocket CVE-2026-54778
MEDIUM
GHSA-q6v9-43v5-jv9q
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Unix Domain Socket limits attack vector to local; race condition requires precise timing (AC:H); socket access needs no credentials by default (PR:N); process crash drives A:H.
Primary rating from Vendor (https://github.com/CoreWCF/CoreWCF).
CVSS VectorVendor: https://github.com/CoreWCF/CoreWCF
Lifecycle Timeline
2DescriptionCVE.org
Impact
Race condition in POSIX peer identity resolution may attribute one connection’s identity to another (getpwuid/getgrgid non-reentrant) and may crash the host process under contention.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
Restrict UDS filesystem permissions so that only trusted local users can connect to the socket path. The race still exists but the attacker pool is constrained.
AnalysisAI
Race condition in CoreWCF.UnixDomainSocket peer identity resolution can cause one connection's POSIX identity to be misattributed to another connection, or crash the host process under contention. The root cause is the library's use of the non-reentrant POSIX functions getpwuid and getgrgid in concurrent connection handling paths, affecting all CoreWCF.UnixDomainSocket versions below 1.8.1 and 1.9.x versions below 1.9.1. No public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CoreWCF is the open-source .NET re-implementation of WCF (Windows Communication Foundation), distributed as NuGet packages. The affected component, CoreWCF.UnixDomainSocket (pkg:nuget/corewcf.unixdomainsocket), provides inter-process communication over Unix Domain Sockets (UDS). When resolving the peer identity of an incoming connection, the library invokes the POSIX functions getpwuid and getgrgid to map numeric UID/GID values to user and group names. Both functions are explicitly non-reentrant per POSIX - they use internal static or global buffers that are overwritten on each call. When multiple threads concurrently resolve peer identities (as happens under load), these calls interleave and corrupt each other's results, producing CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization). The impact is bifurcated: identity confusion (one connection inherits another's resolved user/group) produces low-severity confidentiality and integrity impacts, while unhandled corruption of the resolution state can crash the host process (high availability impact).
RemediationAI
Upgrade CoreWCF.UnixDomainSocket to v1.8.1 (if on the 1.8.x branch) or v1.9.1 (if on the 1.9.x branch), as confirmed by the vendor GitHub Security Advisory at https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-q6v9-43v5-jv9q. These are the vendor-released patch versions. If an immediate upgrade is not feasible, the vendor-endorsed workaround is to restrict the Unix Domain Socket filesystem permissions (e.g., via chmod/chown or systemd socket activation with SocketMode) so that only explicitly trusted local users or service accounts can connect to the socket path. This directly reduces the attacker pool eligible to trigger the race. Note the trade-off: this workaround constrains exploitation opportunity but does not eliminate the race condition - concurrent connections from trusted principals can still trigger identity confusion and host crashes. No additional compensating controls are specified in the advisory.
Same weakness CWE-362 – Race Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today