Open
CVE-2026-16277: Apply fix patch for openEuler-26.09 #65
huijing_zhangAdd on 9 days ago
CVE-2026-16277: Apply fix patch for openEuler-26.09 #65
Open
Total: 2 files changed+37-1
| @@ -0,0 +1,29 @@ | |||
| 1 | +From bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Steve Dickson <steved@redhat.com> | ||
| 3 | +Date: Wed, 27 May 2026 11:42:11 -0400 | ||
| 4 | +Subject: [PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist() | ||
| 5 | + | ||
| 6 | +rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR strings into a fixed 128-byte stack buffer with sprintf(). A malicious or on-path rpcbind server overflows it when a user runs: | ||
| 7 | +rpcinfo -l <host> <prognum> <versnum> | ||
| 8 | + | ||
| 9 | +Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com> | ||
| 10 | +Signed-off-by: Steve Dickson <steved@redhat.com> | ||
| 11 | +--- | ||
| 12 | + src/rpcinfo.c | 2 +- | ||
| 13 | + 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 14 | + | ||
| 15 | +diff --git a/src/rpcinfo.c b/src/rpcinfo.c | ||
| 16 | +index 0e14f78..43e8115 100644 | ||
| 17 | +--- a/src/rpcinfo.c | ||
| 18 | ++++ b/src/rpcinfo.c | ||
| 19 | +@@ -1120,7 +1120,7 @@ rpcbaddrlist (netid, argc, argv) | ||
| 20 | + | ||
| 21 | + re = &head->rpcb_entry_map; | ||
| 22 | + printf ("%10u%3u ", parms.r_prog, parms.r_vers); | ||
| 23 | +- sprintf (buf, "%s/%s/%s ", | ||
| 24 | ++ snprintf (buf, sizeof(buf), "%s/%s/%s ", | ||
| 25 | + re->r_nc_protofmly, re->r_nc_proto, | ||
| 26 | + re->r_nc_semantics == NC_TPI_CLTS ? "clts" : | ||
| 27 | + re->r_nc_semantics == NC_TPI_COTS ? "cots" : "cots_ord"); | ||
| 28 | +-- | ||
| 29 | +2.43.0 | ||
| @@ -3,7 +3,7 @@ | |||
| 3 | 3 | ||
| 4 | Name: rpcbind | 4 | Name: rpcbind |
| 5 | Version: 1.2.7 | 5 | Version: 1.2.7 |
| 6 | -Release: 2 | 6 | +Release: 3 |
| 7 | Summary: Universal addresses to RPC program number mapper | 7 | Summary: Universal addresses to RPC program number mapper |
| 8 | License: BSD-3-Clause | 8 | License: BSD-3-Clause |
| 9 | 9 | ||
| @@ -27,6 +27,7 @@ Patch104: %{name}-0.2.4-systemd-rundir.patch | |||
| 27 | Patch105: bugfix-rpcbind-GETADDR-return-client-ip.patch | 27 | Patch105: bugfix-rpcbind-GETADDR-return-client-ip.patch |
| 28 | Patch6001: CVE-2017-8779.patch | 28 | Patch6001: CVE-2017-8779.patch |
| 29 | Patch6003: backport-debian-enable-rmt-calls-with-r.patch | 29 | Patch6003: backport-debian-enable-rmt-calls-with-r.patch |
| 30 | +Patch6004: backport-CVE-2026-16277.patch | ||
| 30 | Patch9000: bugfix-listen-tcp-port-111.patch | 31 | Patch9000: bugfix-listen-tcp-port-111.patch |
| 31 | 32 | ||
| 32 | Provides: portmap = %{version}-%{release} | 33 | Provides: portmap = %{version}-%{release} |
| @@ -111,6 +112,12 @@ fi | |||
| 111 | %{_mandir}/man8/* | 112 | %{_mandir}/man8/* |
| 112 | 113 | ||
| 113 | %changelog | 114 | %changelog |
| 115 | +* Thu Oct 29 2026 huijing_zhang <zhanghuijing@kylinos.cn> - 1.2.7-3 | ||
| 116 | +- Type:CVE | ||
| 117 | +- CVE:CVE-2026-16277 | ||
| 118 | +- SUG:NA | ||
| 119 | +- DESC:fix CVE-2026-16277 | ||
| 120 | + | ||
| 114 | * Mon Aug 10 2026 <sunhai10@h-partners.com> - 1.2.7-2 | 121 | * Mon Aug 10 2026 <sunhai10@h-partners.com> - 1.2.7-2 |
| 115 | - Type:bugfix | 122 | - Type:bugfix |
| 116 | - Id:NA | 123 | - Id:NA |