Bug 1637562

Description of problem:



Function rpcbdump from the rpcbind binary contains a fixed sized
buffer for the netid:

static void
rpcbdump (dumptype, netid, argc, argv)
     int dumptype;
     char *netid;
     int argc;
     char **argv;
{
...
  char buf[256];
...

which is later filled via:

  for (nl = rs->nlist; nl; nl = nl->next)
            {
              strcat (buf, nl->netid);
              if (nl->next)
                strcat (buf, ",");
            }

This is vulnerable to buffer overflows.
After crafting an malicious rpcbind server by tweaking its
initialization with gdb:

(gdb)
840             rbl->rpcb_next = list_rbl;      /* Attach to global list */
(gdb) python
> gdb.execute('set rbl->rpcb_map.r_netid="'+256*'a'+'"')
> end
(gdb)  print rbl->rpcb_map.r_netid
$1 = 0x555555763d80 'a' <repeats 200 times>...
(gdb) continue
Continuing.
Continuing.
I can trigger an overflow and abort thanks to the FORTIFY_SOURCE
protection of strcat at the remote client side when it requests info:

   program version(s) netid(s)                         service     owner
*** buffer overflow detected ***: rpcinfo terminated
======= Backtrace: =========
/lib64/libc.so.6(+0x721af)[0x7ff24c4451af]
/lib64/libc.so.6(__fortify_fail+0x37)[0x7ff24c4ccdc7]
/lib64/libc.so.6(+0xf8050)[0x7ff24c4cb050]
rpcinfo(+0x435f)[0xef3be2635f]
rpcinfo(+0x1c62)[0xef3be23c62]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7ff24c3f36e5]
rpcinfo(+0x2739)[0xef3be24739]
======= Memory map: ========


Version-Release number of selected component (if applicable):


How reproducible:
100% 




Additional info:

Upstream Commit

commit 0bc1c0ae7ce61a7ac8a8e9a9b2086268f011abf0 
Author: Steve Dickson <steved>
Date:   Tue Oct 9 09:19:50 2018 -0400

    rpcinfo: Fix stack buffer overflow