oss-sec mailing list archives
Re: rpcbomb: remote rpcbind denial-of-service
From: Marcus Meissner <meissner () suse de>
Date: Fri, 5 May 2017 11:22:58 +0200
On Wed, May 03, 2017 at 05:55:20PM -0700, Seth Arnold wrote:
On Wed, May 03, 2017 at 08:55:23PM +0200, Guido Vranken wrote:This vulnerability allows an attacker to allocate any amount of bytes (up to 4 gigabytes per attack) on a remote rpcbind host, and the memory is never freed unless the process crashes or the administrator halts or restarts the rpcbind service. [...] An extensive write-up can be found here: https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/ Exploit + patches: https://github.com/guidovranken/rpcbomb/Hello Guido, nice find. Have CVE numbers been requested for this issue yet? Have you investigated if ntirpc is affected too? Much of the code looks similar: http://sources.debian.net/src/ntirpc/1.4.3-3/src/rpc_generic.c/#L728
We also saw glibc affected. https://bugzilla.suse.com/show_bug.cgi?id=1037559#c7 That said, your reproducer allocates virtual memory, and on systems with overcommit there is only neglible impact on overall memory pressure. The rpc service will however likely crash at some point though when there is no virtual address space left for it. Ciao, Marcus
Current thread:
- rpcbomb: remote rpcbind denial-of-service Guido Vranken (May 03)
- Re: rpcbomb: remote rpcbind denial-of-service Seth Arnold (May 03)
- Re: rpcbomb: remote rpcbind denial-of-service Marcus Meissner (May 05)
- Re: rpcbomb: remote rpcbind denial-of-service Florian Weimer (May 05)
- Re: rpcbomb: remote rpcbind denial-of-service Salvatore Bonaccorso (May 07)
- Re: rpcbomb: remote rpcbind denial-of-service Florian Weimer (May 08)
- Re: rpcbomb: remote rpcbind denial-of-service Marcus Meissner (May 05)
- Re: rpcbomb: remote rpcbind denial-of-service Seth Arnold (May 03)