Libtirpc
Monthly
Unbounded decoding of PMAPPROC_DUMP replies in libtirpc lets a malicious or already-compromised RPC portmapper exhaust the memory and CPU of a client application that calls pmap_getmaps(), crashing or stalling the client process and causing a denial of service. The exposure is conditional and client-side: a remote attacker cannot initiate the exchange, so the victim must direct libtirpc-based tooling (NFS/RPC mount helpers, discovery or inventory scanners) at the attacker-controlled rpcbind, which is why the assessed vector is AV:N/AC:H/PR:N/UI:R with availability-only impact and no confidentiality, integrity, or code-execution consequences. Affected packages are those shipped in Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. At CVSS 5.3 this is a moderate-severity, low-priority issue in practice, and no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.4%.
The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Unbounded decoding of PMAPPROC_DUMP replies in libtirpc lets a malicious or already-compromised RPC portmapper exhaust the memory and CPU of a client application that calls pmap_getmaps(), crashing or stalling the client process and causing a denial of service. The exposure is conditional and client-side: a remote attacker cannot initiate the exchange, so the victim must direct libtirpc-based tooling (NFS/RPC mount helpers, discovery or inventory scanners) at the attacker-controlled rpcbind, which is why the assessed vector is AV:N/AC:H/PR:N/UI:R with availability-only impact and no confidentiality, integrity, or code-execution consequences. Affected packages are those shipped in Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. At CVSS 5.3 this is a moderate-severity, low-priority issue in practice, and no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.4%.
The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.