CVE-2026-16277: Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()

AIONLYREPORT package: rpcbind-1.2.7-3.el10 ------ Summary: Stack Buffer Overflows in rpcinfo: attacker-controlled rpcbind replies can overflow fixed-size stack buffers in rpcinfo -l and rpcinfo -s Requirements to exploit: A user or administrator must run rpcinfo -l host prog vers or rpcinfo -s host against an attacker-controlled or compromised rpcbind endpoint. No privileges on the victim system are required, but the issue is client-side and requires user interaction. Component affected: rpcbind, src/rpcinfo.c, rpcbaddrlist() and rpcbdump() short mode used by rpcinfo -l and rpcinfo -s Version affected: rpcbind-1.2.7-3.el10 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - 6.5 (MEDIUM) AV:N - The attacker supplies a crafted rpcbind reply over the network. AC:L - Exploitation requires only a malicious or compromised rpcbind endpoint returning oversized or overly long reply data. PR:N - No privileges on the victim system are required. UI:R - A user or administrator must invoke rpcinfo against the hostile host. S:U - The impact is confined to the rpcinfo process. C:N - The available evidence does not demonstrate disclosure of victim data. I:N - The available evidence does not demonstrate modification of victim data or reliable code execution. A:H - The available evidence supports client-side stack memory corruption leading to crash or denial of service. Impact: Moderate. This issue is network-reachable through attacker-controlled rpcbind replies, but it affects the rpcinfo client shipped by rpcbind, not the rpcbind service itself, and it requires explicit user interaction. Current evidence supports client crash and denial of service; confidentiality, integrity, and reliable code execution are not established. Under Red Hat's severity guidance, this is better classified as Moderate than Important because the flaw is less easily exploitable in practice and the demonstrated impact is limited to a user-invoked diagnostic path. Embargo: no Reason: This is a client-side issue requiring user interaction, with currently demonstrated crash-level impact and straightforward operational mitigation by avoiding untrusted rpcbind hosts until a fix is available. Acknowledgement: Aisle Research Vulnerability Details: rpcinfo contains two separate unbounded sprintf operations on fixed-size stack buffers while formatting fields derived from rpcbind replies. In rpcbaddrlist(), used by rpcinfo -l, reply fields from RPCBPROCGETADDRLIST are written into char buf[128] without length checks: c char buf[128]; sprintf (buf, "%s/%s/%s ", re->rncprotofmly, re->rncproto, re->rncsemantics == NCTPICLTS ? "clts" : re->rncsemantics == NCTPICOTS ? "cots" : "cotsord"); re->rncprotofmly and re->rncproto come from the remote reply. A malicious or compromised rpcbind host can therefore provide strings long enough to overflow buf. In rpcbdump() short mode, used by rpcinfo -s, version values from the reply are appended into char buf[256] without tracking remaining space: c char buf[256]; char p = buf; for (vl = rs->vlist; vl; vl = vl->next) { sprintf (p, "%d", vl->vers); p = p + strlen (p); if (vl->next) sprintf (p++, ","); } A hostile reply that supplies enough distinct versions for a single program can overflow this buffer. Based on the available evidence, roughly 24 maximum-width decimal version values plus commas are sufficient to exceed 256 bytes. The currently supported conclusion is client-side stack memory corruption leading to a crash; more severe outcomes are not established by the available data. Steps to reproduce: 1. Build rpcbind with AddressSanitizer enabled: CFLAGS="-O1 -g -fsanitize=address -fno-omit-frame-pointer" ./configure && make -j 2. Run a malicious rpcbind-compatible endpoint, or an instrumented test responder, and point rpcinfo at it. 3. To trigger the -l overflow, return one RPCBPROCGETADDRLIST entry where rncprotofmly plus rncproto, together with the separators and semantics string, exceed 128 bytes, then run ./src/rpcinfo -l <attacker-host> 100000 2. 4. To trigger the -s overflow, return a RPCBPROCDUMP list for one program with many distinct versions. About 24 maximum-width decimal versions plus commas can exceed 256 bytes. Then run ./src/rpcinfo -s <attacker-host>. 5. Observe an ASan stack-buffer-overflow report or a client crash at the cited call sites. Mitigation: Until a fix is available, avoid using rpcinfo -l or rpcinfo -s against untrusted, attacker-controlled, or compromised rpcbind hosts. Limit use of the utility to trusted internal endpoints or trusted test environments. Proposed Fix: Replace the unbounded sprintf in rpcbaddrlist() with a bounded snprintf(), and convert the version-list formatter in rpcbdump() to bounded writes that track remaining buffer space. diff diff --git a/src/rpcinfo.c b/src/rpcinfo.c — a/src/rpcinfo.c +++ b/src/rpcinfo.c @@ -1124,8 +1124,9 @@ sprintf (buf, "%s/%s/%s ",

re->rncprotofmly, re->rncproto, + snprintf (buf, sizeof(buf), "%s/%s/%s ", + re->rncprotofmly ? re->rncprotofmly : "", + re->rncproto ? re->rncproto : "", re->rncsemantics == NCTPICLTS ? "clts" : re->rncsemantics == NCTPICOTS ? "cots" : "cotsord");

@@ -977,12 +978,18 @@ char p = buf; + char p = buf; + sizet rem = sizeof(buf); + int n; + buf[0] = '\0'; for (vl = rs->vlist; vl; vl = vl->next) {

sprintf (p, "%d", vl->vers);

p = p + strlen (p);

if (vl->next)

sprintf (p++, ","); + n = snprintf(p, rem, "%d%s", vl->vers, vl->next ? "," : ""); + if (n < 0) + break; + if ((sizet)n >= rem) { + p = buf + sizeof(buf) - 1; + break; + } + p += n; + rem -= (sizet)n; }

------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat