Bug 1637567
| Summary: | rpcinfo: Fix stack buffer overflow | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Steve Dickson <steved> | |
| Component: | rpcbind | Assignee: | Steve Dickson <steved> | |
| Status: | CLOSED ERRATA | QA Contact: | Yongcheng Yang <yoyang> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | high | |||
| Version: | 7.7 | CC: | extras-qa, rhandlin, steved, xzhou, yoyang | |
| Target Milestone: | rc | Keywords: | Patch, ZStream | |
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | rpcbind-0.2.0-48.el7 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | 1637562 | |||
| : | 1668668 (view as bug list) | Environment: | ||
| Last Closed: | 2019-08-06 13:17:35 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1637562 | |||
| Bug Blocks: | 1637565, 1668668 | |||
|
Description
Steve Dickson
2018-10-09 13:44:03 UTC
Have verified the rpcbind-0.2.0-48.el7 using tool gdb. [root ~]# ps aux | grep -v grep | grep rpcbind [root ~]# gdb rpcbind -w -f GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-115.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/rpcbind...Reading symbols from /usr/lib/debug/usr/sbin/rpcbind.debug...done. done. (gdb) break 802 Breakpoint 1 at 0x7e71: file src/rpcbind.c, line 802. (gdb) r Starting program: /usr/sbin/rpcbind [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Breakpoint 1, rbllist_add (vers=3, nconf=0x5555557639a0, addr=0x7fffffffde50, prog=100000) at src/rpcbind.c:802 /usr/src/debug/rpcbind-0.2.0/src/rpcbind.c:802:20898:beg:0x55555555be71 (gdb) print rbl->rpcb_map.r_netid $1 = 0x555555765a70 "local" (gdb) python >gdb.execute('set rbl->rpcb_map.r_netid="'+256*'a'+'"') >end (gdb) print rbl->rpcb_map.r_netid $2 = 0x555555765b40 'a' <repeats 200 times>... (gdb) c Continuing. ... Breakpoint 1, rbllist_add (vers=4, nconf=0x555555772ca0, addr=0x7fffffffde50, prog=100000) at src/rpcbind.c:802 /usr/src/debug/rpcbind-0.2.0/src/rpcbind.c:802:20898:beg:0x55555555be71 (gdb) c Continuing. Detaching after fork from child process 4138. [Inferior 1 (process 4095) exited normally] (gdb) q [root ~]# ps aux | grep -v grep | grep rpcbind rpc 4138 0.3 0.0 69276 1436 ? Ss 21:54 0:00 /usr/sbin/rpcbind [root ~]# rpcinfo -s program version(s) netid(s) service owner 100000 2,3,4 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa portmapper superuser [root ~]# echo $? 0 [root ~]# rpm -q rpcbind rpcbind-0.2.0-48.el7.x86_64 [root ~]# Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2311 |