Re: rpcbomb: remote rpcbind denial-of-service

[Seth Arnold <seth.arnold () canonical com>]

On Wed, May 03, 2017 at 08:55:23PM +0200, Guido Vranken wrote:
> This vulnerability allows an attacker to allocate any amount of bytes
> (up to 4 gigabytes per attack) on a remote rpcbind host, and the
> memory is never freed unless the process crashes or the administrator
> halts or restarts the rpcbind service.
> [...]
> An extensive write-up can be found here:
> https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/
>
> Exploit + patches: https://github.com/guidovranken/rpcbomb/

Hello Guido, nice find. Have CVE numbers been requested for this issue
yet? Have you investigated if ntirpc is affected too? Much of the code
looks similar:

http://sources.debian.net/src/ntirpc/1.4.3-3/src/rpc_generic.c/#L728

Thanks

Attachment: signature.asc
Description: