Open
fix CVE-2026-16277 #55
zhangwenyi0929Add on Aug 7
fix CVE-2026-16277 #55
Open
Total: 2 files changed+37-1
| @@ -0,0 +1,29 @@ | |||
| 1 | +From bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Steve Dickson <steved@redhat.com> | ||
| 3 | +Date: Wed, 27 May 2026 11:42:11 -0400 | ||
| 4 | +Subject: [PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist() | ||
| 5 | + | ||
| 6 | +rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR strings into a fixed 128-byte stack buffer with sprintf(). A malicious or on-path rpcbind server overflows it when a user runs: | ||
| 7 | +rpcinfo -l <host> <prognum> <versnum> | ||
| 8 | + | ||
| 9 | +Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com> | ||
| 10 | +Signed-off-by: Steve Dickson <steved@redhat.com> | ||
| 11 | +--- | ||
| 12 | + src/rpcinfo.c | 2 +- | ||
| 13 | + 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 14 | + | ||
| 15 | +diff --git a/src/rpcinfo.c b/src/rpcinfo.c | ||
| 16 | +index 0e14f78..43e8115 100644 | ||
| 17 | +--- a/src/rpcinfo.c | ||
| 18 | ++++ b/src/rpcinfo.c | ||
| 19 | +@@ -1120,7 +1120,7 @@ rpcbaddrlist (netid, argc, argv) | ||
| 20 | + | ||
| 21 | + re = &head->rpcb_entry_map; | ||
| 22 | + printf ("%10u%3u ", parms.r_prog, parms.r_vers); | ||
| 23 | +- sprintf (buf, "%s/%s/%s ", | ||
| 24 | ++ snprintf (buf, sizeof(buf), "%s/%s/%s ", | ||
| 25 | + re->r_nc_protofmly, re->r_nc_proto, | ||
| 26 | + re->r_nc_semantics == NC_TPI_CLTS ? "clts" : | ||
| 27 | + re->r_nc_semantics == NC_TPI_COTS ? "cots" : "cots_ord"); | ||
| 28 | +-- | ||
| 29 | +2.43.0 | ||
| @@ -3,7 +3,7 @@ | |||
| 3 | 3 | ||
| 4 | Name: rpcbind | 4 | Name: rpcbind |
| 5 | Version: 1.2.6 | 5 | Version: 1.2.6 |
| 6 | -Release: 8 | 6 | +Release: 9 |
| 7 | Summary: Universal addresses to RPC program number mapper | 7 | Summary: Universal addresses to RPC program number mapper |
| 8 | License: BSD | 8 | License: BSD |
| 9 | 9 | ||
| @@ -29,6 +29,7 @@ Patch105: bugfix-rpcbind-GETADDR-return-client-ip.patch | |||
| 29 | Patch6001: CVE-2017-8779.patch | 29 | Patch6001: CVE-2017-8779.patch |
| 30 | Patch6002: backport-fix-double-free-in-init_transport.patch | 30 | Patch6002: backport-fix-double-free-in-init_transport.patch |
| 31 | Patch6003: backport-debian-enable-rmt-calls-with-r.patch | 31 | Patch6003: backport-debian-enable-rmt-calls-with-r.patch |
| 32 | +Patch6004: backport-CVE-2026-16277.patch | ||
| 32 | Patch9000: bugfix-listen-tcp-port-111.patch | 33 | Patch9000: bugfix-listen-tcp-port-111.patch |
| 33 | 34 | ||
| 34 | Provides: portmap = %{version}-%{release} | 35 | Provides: portmap = %{version}-%{release} |
| @@ -122,6 +123,12 @@ fi | |||
| 122 | %{_mandir}/man8/*.8.gz | 123 | %{_mandir}/man8/*.8.gz |
| 123 | 124 | ||
| 124 | %changelog | 125 | %changelog |
| 126 | +* Fri Aug 07 2026 zhangwenyi <zhangwenyi@xfusion.com> - 1.2.6-9 | ||
| 127 | +- Type:CVE | ||
| 128 | +- CVE:CVE-2026-16277 | ||
| 129 | +- SUG:NA | ||
| 130 | +- DESC:fix CVE-2026-16277 | ||
| 131 | + | ||
| 125 | * Wed Dec 18 2024 sunsuwan <sunsuwan3@huawei.com> - 1.2.6-8 | 132 | * Wed Dec 18 2024 sunsuwan <sunsuwan3@huawei.com> - 1.2.6-8 |
| 126 | - Type:bugfix | 133 | - Type:bugfix |
| 127 | - Id:NA | 134 | - Id:NA |