This vulnerability in sblim-sfcb arises from unsafe deserialization during inter-process communication message parsing by the provider-manager component. A local attacker with low privileges can exploit this by sending a specially crafted IPC message, triggering out-of-bounds memory access (CWE-125). This results in termination of the provider-manager process, causing denial of service, and may also lead to limited unintended information disclosure. The attack vector is local with low complexity and no user interaction required. Exploitation depends on local IPC configuration and socket permissions, limiting its impact. Red Hat advisory recommends restricting access to the local connect socket and securing IPC channels to mitigate risk. No official patch or fix has been announced yet.

The vulnerability allows a local attacker to cause a denial of service by crashing the provider-manager process through out-of-bounds memory access. Additionally, limited unintended information disclosure may occur, potentially leaking sensitive memory contents. The attack requires local access and depends on IPC socket permissions, which limits broader exploitation. The CVSS 3.1 score is 6.6 (medium severity) reflecting low confidentiality and integrity impact but high availability impact.

No official patch or fix is currently confirmed. To mitigate this vulnerability, restrict access to the local connect socket used by sblim-sfcb to prevent untrusted local users from accessing the provider-manager IPC channel. Ensure that only trusted users can reach this socket by securing local IPC channels and socket permissions. A restart of the sfcbd service may be required for changes to take effect, which could temporarily disrupt dependent services. Follow your system documentation for securing IPC mechanisms related to sblim-sfcb.