The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 2042018]
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2022:0896 https://access.redhat.com/errata/RHSA-2022:0896
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):