Bug 1337136 – CVE-2016-4429 glibc: libtirpc: stack (frame) overflow in Sun RPC clntudp_call()

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1337136 - (CVE-2016-4429) CVE-2016-4429 glibc: libtirpc: stack (frame) overflow in Sun RPC clntudp_call()

Summary:	CVE-2016-4429 glibc: libtirpc: stack (frame) overflow in Sun RPC clntudp_call()

Status:	CLOSED WONTFIX

Aliases:	CVE-2016-4429

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20160518,reported=2...
Keywords:	Security

Depends On:	1337140 1337142
Blocks:
	Show dependency tree / graph

Reported:	2016-05-18 07:45 EDT by Martin Prpič
Modified:	2016-11-10 14:57 EST (History)
CC List:	16 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-05-18 07:54:03 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
CVE-2016-4429 patch (946 bytes, text/plain) 2016-05-18 07:49 EDT, Martin Prpič	no flags	Details
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Sourceware	20112	None	None	None	2016-05-18 07:59 EDT

Groups: None (edit)

Description Martin Prpič 2016-05-18 07:45:34 EDT

A stack frame overflow flaw was found in the glibc's clntudp_call(). A malicious server could use this flaw to flood a connecting client application with ICMP and UDP packets, triggering the stack overflow and resulting in a crash.

clntudp_call() contains an alloca call in a loop, which causes it to consume very large amounts of stack space.

The same faulty code is also present in the libtirpc library.

Comment 1 Martin Prpič 2016-05-18 07:45:49 EDT

Acknowledgments:

Name: Aldy Hernandez (Red Hat)

Comment 2 Martin Prpič 2016-05-18 07:47:47 EDT

Created libtirpc tracking bugs for this issue:

Affects: fedora-all [bug 1337142]

Comment 3 Martin Prpič 2016-05-18 07:47:56 EDT

Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1337140]

Comment 5 Martin Prpič 2016-05-18 07:49 EDT

Created attachment 1158765 [details]
CVE-2016-4429 patch

Comment 6 Adam Mariš 2016-07-07 04:31:42 EDT

Statement:

Red Hat Product Security has rated this issue as having Low security impact, a future update may address this flaw.

Note You need to log in before you can comment on or make changes to this bug.