CyberRota Analysis
AI-GeneratedCoreWCF versions prior to 1.8.1 and 1.9.1 on Windows are vulnerable due to improper handling of UnixDomainSocket POSIX peer identity resolution, which can lead to identity misattribution between concurrent connections or potentially crash the host process. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate the risk of unauthorized access and service disruption. This vulnerability is particularly relevant for developers and system administrators managing applications that utilize CoreWCF for communication.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.