The vulnerability in kronosnet's cryptographic configuration management (versions up to 1.34) arises from improper removal of sensitive information from memory. Specifically, encryption keys remain in memory after the associated data structures are freed because the framework does not zero-out or wipe these memory segments. A local attacker who can perform memory disclosure attacks could exploit this to obtain active encryption keys, enabling decryption of cluster network traffic or injection of malicious packets, which may lead to high-availability cluster instability. The CVSS 3.1 base score is 5.8, reflecting a medium severity with local attack vector, high attack complexity, low privileges required, and significant confidentiality impact.

An attacker with local access and the ability to perform memory disclosure could retrieve active encryption keys from memory. This compromises the confidentiality of cluster network communications and may allow the attacker to inject malicious packets, potentially causing instability in high-availability clusters. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not specify an available patch or workaround at this time. Users should monitor the Red Hat advisory page for updates and apply any official fixes once released. Until then, limiting local access and preventing memory disclosure techniques may reduce risk.