Bug 1668668
| Summary: | rpcinfo: Fix stack buffer overflow [rhel-7.6.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | RAD team bot copy to z-stream <autobot-eus-copy> |
| Component: | rpcbind | Assignee: | Steve Dickson <steved> |
| Status: | CLOSED ERRATA | QA Contact: | Yongcheng Yang <yoyang> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.6 | CC: | steved, xzhou, yoyang |
| Target Milestone: | rc | Keywords: | Patch, ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | rpcbind-0.2.0-47.el7_6 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1637567 | Environment: | |
| Last Closed: | 2020-08-18 12:52:12 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1637567 | ||
| Bug Blocks: | |||
|
Description
RAD team bot copy to z-stream
2019-01-23 09:52:57 UTC
Verified the rpcbind-0.2.0-47.el7_8 manually using the tool gdb. [root@ ~]# ps aux | grep -v grep | grep rpcbind [root@ ~]# gdb rpcbind -w -f GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-114.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/rpcbind...Reading symbols from /usr/lib/debug/usr/sbin/rpcbind.debug...done. done. (gdb) break 802 Breakpoint 1 at 0x7df1: file src/rpcbind.c, line 802. (gdb) r Starting program: /usr/sbin/rpcbind [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Breakpoint 1, rbllist_add (vers=3, nconf=0x5555557639a0, addr=0x7fffffffde60, prog=100000) at src/rpcbind.c:802 /usr/src/debug/rpcbind-0.2.0/src/rpcbind.c:802:20898:beg:0x55555555bdf1 (gdb) print rbl->rpcb_map.r_netid $1 = 0x555555765a70 "local" (gdb) python >gdb.execute('set rbl->rpcb_map.r_netid="'+256*'a'+'"') >end (gdb) print rbl->rpcb_map.r_netid $2 = 0x555555765b40 'a' <repeats 200 times>... (gdb) c Continuing. Breakpoint 1, rbllist_add (vers=4, nconf=0x5555557639a0, addr=0x7fffffffde60, prog=100000) at src/rpcbind.c:802 /usr/src/debug/rpcbind-0.2.0/src/rpcbind.c:802:20898:beg:0x55555555bdf1 (gdb) c Continuing. Detaching after fork from child process 17615. [Inferior 1 (process 17579) exited normally] (gdb) q [root@ ~]# ps aux | grep -v grep | grep rpcbind rpc 17615 0.3 0.0 73648 1636 ? Ss 03:20 0:00 /usr/sbin/rpcbind [root@ ~]# rpcinfo -s program version(s) netid(s) service owner 100000 3,4 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa portmapper superuser [root@ ~]# rpm -q rpcbind rpcbind-0.2.0-47.el7_6.x86_64 [root@ ~]# (In reply to Yongcheng Yang from comment #2) > Verified the rpcbind-0.2.0-47.el7_8 manually using the tool gdb. Correct: should be rpcbind-0.2.0-47.el7_6 No new issue found in the regression tests. I'm moving this to VERIFIED based on comment #2 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (rpcbind bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:3480 |