Hi,

The following vulnerabilities were published for kronosnet.

CVE-2026-15811[0]:
| A vulnerability was found in kronosnet's (version <=1.34)
| cryptographic configuration management. The framework does not
| correctly zero-out or wipe sensitive memory segments after executing
| changes to its cryptographic configuration. This omission leaves raw
| encryption keys resident in memory after the associated structures
| are freed. A local attacker capable of leveraging memory disclosure
| techniques could exploit this flaw to retrieve the active encryption
| key, allowing them to decrypt cluster network communications or
| inject malicious packets to cause severe high-availability cluster
| instability.


CVE-2026-15812[1]:
| A vulnerability was found in the internal Access Control List (ACL)
| subsystem of kronosnet (Version affected: <= 1.34). When the
| framework is explicitly configured to manage dynamic links
| (accepting network traffic from any IP address) without network
| payload encryption, the validation architecture implicitly trusts
| the link ID provided within incoming data packets. A remote,
| unauthenticated attacker can exploit this lack of validation by
| spoofing a legitimate link ID inside crafted network frames. This
| allows the attacker to fully bypass the ACL framework and inject
| arbitrary data packets into the application layer, potentially
| leading to data corruption or service instabilities.


CVE-2026-15813[2]:
| A vulnerability was found in the network packet de-fragmentation
| engine of kronosnet (Version affected <= 1.34). The internal
| reassembly code does not properly validate sequence numbers of
| incoming payload fragments. An attacker can exploit this lack of
| verification by transmitting malformed packets with corrupted
| sequence parameters. Under specific conditions, this forces the
| packet processing layer to parse data outside the designated bounds
| of the internal memory structures, causing an out-of-bounds memory
| access or heap corruption. This behavior can result in sudden
| application crashes or system instability.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-15811
https://www.cve.org/CVERecord?id=CVE-2026-15811
[1] https://security-tracker.debian.org/tracker/CVE-2026-15812
https://www.cve.org/CVERecord?id=CVE-2026-15812
[2] https://security-tracker.debian.org/tracker/CVE-2026-15813
https://www.cve.org/CVERecord?id=CVE-2026-15813

Regards,
Salvatore

The Debian NEW review of kronosnet 1.35-1 has been completed.

Decision: ACCEPTED
Reviewer: Andrew McMillan

Review comment:

Hi,

The package is accepted, and DFSG compliance is OK, however the review finds some minor issues...


Licensing accuracy issues

1. Wrong LGPL version in debian/copyright — the main issue.

debian/copyright:12 declares libknet/* and libnozzle/* as LGPL-2.1+ and references /usr/share/common-licenses/LGPL-2.1 (line 38). But every source file header says LGPL-2.0+ (the older GNU Library GPL v2.0, a different license from LGPL-2.1). E.g.:
- libknet/common.c:6, libknet/handle.c:7, libknet/libknet.h:7, libnozzle/libnozzle.c:6 → all "LGPL-2.0+".
The copyright file therefore states the wrong license version and points to the wrong common-license file. (Upstream's own README.licence also says 2.1, so the mismatch likely came from copying that rather than the per-file headers — but debian/copyright must reflect the source headers.)

2. Wireshark dissector mis-declared as GPL.

libknet/wireshark/packet-kronosnet.{c,h} are LGPL-2.0+ (packet-kronosnet.c:8). But the glob libknet/* in DEP-5 does not match subdirectories, so these files fall through to the catch-all Files: * → GPL-2+ (debian/copyright:5-7). Wrong license declared for the shipped kronosnet-wireshark plugin.

3. Build files under the libraries declared LGPL but actually GPL.

libknet/Makefile.am:7, libnozzle/Makefile.am:7 (and generated Makefile.in) are GPL-2.0+, yet they sit directly in libknet//libnozzle/ so they match the libknet/*/libnozzle/* globs and are declared LGPL-2.1+. Wrong.

4. Minor: config.guess/config.sub mis-versioned.

These are GPL-3+ (with the FSF exception), but the copyright file only lists them under the catch-all Files: * → GPL-2+. Note the maintainer did single out build-aux/git-version-gen as GPL-3+ (debian/copyright:18-21) but missed these two.

Non-license packaging note

debian/rules:15 sets --docdir=/usr/share/doc/libknet1, pointing at the pre-time64 name (the package is now libknet1t64). The files it installs there are then discarded via debian/not-installed, so only man pages actually ship (in libknet-doc). This works but is stale/inconsistent with the current package naming.


I hope this is useful.

Thanks!

Full review details: https://dfsg-new-queue.debian.org/reviews/kronosnet

We believe that the bug you reported is fixed in the latest version of
kronosnet, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142847@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ferenc Wágner <wferi@debian.org> (supplier of updated kronosnet package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 27 Sep 2026 20:22:30 +0200
Source: kronosnet
Binary: kronosnet-wireshark kronosnet-wireshark-dbgsym libknet-dev libknet-doc libknet1t64 libknet1t64-dbgsym libnozzle-dev libnozzle1t64 libnozzle1t64-dbgsym
Architecture: source amd64 all
Version: 1.35-1
Distribution: unstable
Urgency: medium
Maintainer: Debian HA Maintainers <debian-ha-maintainers@alioth-lists.debian.net>
Changed-By: Ferenc Wágner <wferi@debian.org>
Description:
 kronosnet-wireshark - kronosnet protocol dissector for Wireshark
 libknet-dev - kronosnet core switching implementation (developer files)
 libknet-doc - kronosnet core API documentation
 libknet1t64 - kronosnet core switching implementation
 libnozzle-dev - userland wrapper around kernel tap devices (developer files)
 libnozzle1t64 - userland wrapper around kernel tap devices
Closes: 1142847
Changes:
 kronosnet (1.35-1) unstable; urgency=medium
 .
   * [c61640a] New upstream release (1.35) (Closes: #1142847)
     Contains fixes for CVE-2026-15811, CVE-2026-15812 and CVE-2026-15813.
   * [bd53aef] Update Standards-Version to 4.7.4 (no changes required)
   * [db73b61] New patch: libknet/wireshark/Makefile.am: handle.c uses ceil,
     which generally requires using the math library
   * [cc02831] Upstream commit 39327848 converted README to Markdown
   * [bf2291b] New binary package for the dissector: kronosnet-wireshark
   * [6c1f5aa] Update symbols files
   * [0210371] Update watch file to version 5
   * [0ace58d] New patch: libknet/wireshark/Makefile.am: use our generic compiler
     and linker flags
   * [d3c6583] debian/tests: do not rely on testbed reuse.
     Autopkgtest 6 stopped reusing testbeds for better isolation, thus we
     need to configure separately for the two test suites.
   * [01d1056] debian/tests/control: add the new libwireshark-dev build
     dependency
Checksums-Sha1:
 1895ccb27638b0d6351d857c9452284e28188a87 3020 kronosnet_1.35-1.dsc
 02ac7857a54a045df894e3d2327761c9137b2920 546068 kronosnet_1.35.orig.tar.xz
 4ba16bcacc0e2d32e237034f4a637d2e4be07620 833 kronosnet_1.35.orig.tar.xz.asc
 eb855328fcd3fc0adfa686b4a6a4e4db7b0c35d4 12524 kronosnet_1.35-1.debian.tar.xz
 b8b0205da75144840341be49f54c6573a0344b96 226984 kronosnet-wireshark-dbgsym_1.35-1_amd64.deb
 9b158a2f445c9163637ab6b04b18fe240cd67ab2 120348 kronosnet-wireshark_1.35-1_amd64.deb
 c81cfe26923ea0e7134533595137cbe45c71682d 11779 kronosnet_1.35-1_amd64.buildinfo
 e350a5e32a04f723dcfb3b8c6cb7e7a96074c957 118428 libknet-dev_1.35-1_amd64.deb
 34cbd6c8e5a5f44f26b435d8a67119be2ec087cf 194964 libknet-doc_1.35-1_all.deb
 0d609dbad991e48903b0338e2a9fc97eeeb6578f 561160 libknet1t64-dbgsym_1.35-1_amd64.deb
 9e15980da56b8e7d3a5241b429d3120edd5134cc 166896 libknet1t64_1.35-1_amd64.deb
 eeb1ea3e73b5a14c0aa48c1fa465114b73028302 104072 libnozzle-dev_1.35-1_amd64.deb
 096697d6f0f8a9b50ebdc6cf828f8f788c1c514b 102588 libnozzle1t64-dbgsym_1.35-1_amd64.deb
 9d119d47a7de54e62e73e62d7d0541aab8a70325 110424 libnozzle1t64_1.35-1_amd64.deb
Checksums-Sha256:
 e9aa08aeb19b93b81d5bf67c5400aa9fb4aa2c46ebfd9fddfc60bb81a24db3fb 3020 kronosnet_1.35-1.dsc
 e980d57a75c9ae9ca4ba2826cd3b02bcbc6463a32aaac0d0ab8eb0b6b5df8d0a 546068 kronosnet_1.35.orig.tar.xz
 787660375a0bba6e380735f06af2381c072cc53f52aba001c8deca253457e328 833 kronosnet_1.35.orig.tar.xz.asc
 1e2804fac6a1304a2cabbafe4d0c4ccc699a4a5923a1bfdabc46ebe09877eb09 12524 kronosnet_1.35-1.debian.tar.xz
 3252363424711d1c12b1a123f8033fee6c890dd65e62b6525e850dc45f225a6e 226984 kronosnet-wireshark-dbgsym_1.35-1_amd64.deb
 2f22fd3885d3c23ba7719a57998c4aa2832fed6e9b63342c7de45bc52b73694e 120348 kronosnet-wireshark_1.35-1_amd64.deb
 814e93cbe628ab73ec5d4bc0c3c3d3fa6186654998294003066379a4c48dd4dc 11779 kronosnet_1.35-1_amd64.buildinfo
 265527f104077621334bb84b44dffca399022b07816422b2405fd326256ad058 118428 libknet-dev_1.35-1_amd64.deb
 b31267ea1e9edf4a053378cb2baf248dd26195e59339939a61c7a6c38b9a1472 194964 libknet-doc_1.35-1_all.deb
 9f4662513ac9ef21be04e683af68275bd2b85f0223636f0e01bbeb1ed24ec6fb 561160 libknet1t64-dbgsym_1.35-1_amd64.deb
 aeaa52d049bed63889357803dda0b448ad3666731499fd8962d47f71f4ec5011 166896 libknet1t64_1.35-1_amd64.deb
 9b36a24df1fae0409d0db58fbd895393b26c4c45d600a377b9e67f618964dd27 104072 libnozzle-dev_1.35-1_amd64.deb
 fcec586b45a54d97ee366d7793ecde9084e114c4ba6be0a618b43897af7708a3 102588 libnozzle1t64-dbgsym_1.35-1_amd64.deb
 d512c5fabac963956ecf5353d3c5b4429da44eb31eafc8b6180307893e6b9c80 110424 libnozzle1t64_1.35-1_amd64.deb
Files:
 d5aff1309952b56a54be2fb26ecd9b7f 3020 admin optional kronosnet_1.35-1.dsc
 38973ebe3f7b3dd44efe13b70515684d 546068 admin optional kronosnet_1.35.orig.tar.xz
 e465d3c4024e4db627c6e6c809a8c5bd 833 admin optional kronosnet_1.35.orig.tar.xz.asc
 49a6a2db8b8030f87b09939f236b2224 12524 admin optional kronosnet_1.35-1.debian.tar.xz
 6d43fc5f9438ebb699de63acc4cc4016 226984 debug optional kronosnet-wireshark-dbgsym_1.35-1_amd64.deb
 3e8c0b870f48d7b12282208911202415 120348 net optional kronosnet-wireshark_1.35-1_amd64.deb
 e70924e88591c833d5acd4b472d990e7 11779 admin optional kronosnet_1.35-1_amd64.buildinfo
 5746f24fbd906eb2b64789f2a6b13148 118428 libdevel optional libknet-dev_1.35-1_amd64.deb
 f51eb459b2752f8ad3836162463a7e3f 194964 doc optional libknet-doc_1.35-1_all.deb
 68b13eb2b81f9aff8770b3b265fdadde 561160 debug optional libknet1t64-dbgsym_1.35-1_amd64.deb
 941850c687b66892b032f81a6eb02c8a 166896 libs optional libknet1t64_1.35-1_amd64.deb
 8f8715e668511c44ddbbaf1ffe8a5642 104072 libdevel optional libnozzle-dev_1.35-1_amd64.deb
 19b4d3abdd4536ade4125cc145faba71 102588 debug optional libnozzle1t64-dbgsym_1.35-1_amd64.deb
 f8460b7052b28c580e5541dde7cc7427 110424 libs optional libnozzle1t64_1.35-1_amd64.deb
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwddEx0RNIUL7eugtOsj3Fkd+2yMFAmq5fdkACgkQOsj3Fkd+
2yOuKRAAmSao5wCX8xpdyCH7N6RNp4G8D5sjIMAsR6DGoEHYcuv3Hbrd6xHRC3dQ
hA13PJZ685nKtUaKC3q8NAsD4Gd0YFnOb1lHTDeQkkOyqH5XOrK9+X4NtRpD9CAL
4Yrs78skIudpCNZLq4T4PHvZalcgfYSfu5hRaai3SkTxFcGGKUDHmc+erQH5cXmR
H/w0vUexGT7CWqzJRu26Kd0Tlrg6yCrtyVI7WgAqxVUKYPp9BqPq1aA4B55765pJ
oGobFM7W96FkHVgBgsnMkbqqBklrWSMKKOdLOIW+/nAHtKLq1yB98WEfFnWO/qKP
AMBu11PmdMr4W5HEkLJ413qqj49McZhNNZiB9dZ9OqEBXWdA1E5mMKEk/wLd2f9T
veiiy79pK9JwKQLpavx72Sa1P92O8DyOoNb6m+1lTZDgNp5qOU9iIa3MO0n0acij
1slnC/rxyOb4qtWwtmEaYRNn3ZIcDjVrxMqkhTnBWJZ0h+jbckhOknAqkkCkvHw4
Ytyk042eFMTH6aSXq7dKY1jb9WYwMAOyzt9YY2RmW1gl+92gEXqOXz8AciJJ9n9H
8lDLW1xf5zQ1+FBflC/OBQG9N4eA6XpMWTVCDnWxjHoF9uxL/p4mkpQC9oCd/6bz
kCPM35m//b2QMHXRkNtj+ODnu4gIIq0al4u1Ysg4meCWqsZn3PQ=
=igmX
-----END PGP SIGNATURE-----