diff mbox series

[scarthgap] rpcbind: Fix CVE-2026-16277

Message ID 20260814113323.1033135-1-vanusuri@mvista.com
State New
Headers show
Series [scarthgap] rpcbind: Fix CVE-2026-16277 | expand

Commit Message

Vijay Anusuri Aug. 14, 2026, 11:33 a.m. UTC 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-16277
[2] https://security-tracker.debian.org/tracker/CVE-2026-16277

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 .../rpcbind/rpcbind/CVE-2026-16277.patch      | 34 +++++++++++++++++++
 .../recipes-extended/rpcbind/rpcbind_1.2.6.bb |  1 +
 2 files changed, 35 insertions(+)
 create mode 100644 meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
diff mbox series

Patch

diff --git a/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch b/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
new file mode 100644
index 0000000000..868e5c3f01
--- /dev/null
+++ b/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
@@ -0,0 +1,34 @@ 
+From bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d Mon Sep 17 00:00:00 2001
+From: Steve Dickson <steved@redhat.com>
+Date: Wed, 27 May 2026 11:42:11 -0400
+Subject: [PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist()
+
+rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR strings into a fixed 128-byte stack buffer with sprintf(). A malicious or on-path rpcbind server overflows it when a user runs:
+rpcinfo -l <host> <prognum> <versnum>
+
+Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com>
+Signed-off-by: Steve Dickson <steved@redhat.com>
+
+Upstream-Status: Backport [https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d]
+CVE: CVE-2026-16277
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ src/rpcinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/rpcinfo.c b/src/rpcinfo.c
+index 0e14f78..43e8115 100644
+--- a/src/rpcinfo.c
++++ b/src/rpcinfo.c
+@@ -1120,7 +1120,7 @@ rpcbaddrlist (netid, argc, argv)
+ 
+ 	  re = &head->rpcb_entry_map;
+ 	  printf ("%10u%3u    ", parms.r_prog, parms.r_vers);
+-	  sprintf (buf, "%s/%s/%s ",
++	  snprintf (buf, sizeof(buf), "%s/%s/%s ",
+ 		   re->r_nc_protofmly, re->r_nc_proto,
+ 		   re->r_nc_semantics == NC_TPI_CLTS ? "clts" :
+ 		   re->r_nc_semantics == NC_TPI_COTS ? "cots" : "cots_ord");
+-- 
+2.43.0
+
diff --git a/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb b/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
index dbd4d32e0a..07e2f10c98 100644
--- a/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
+++ b/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
@@ -15,6 +15,7 @@  SRC_URI = "${SOURCEFORGE_MIRROR}/rpcbind/rpcbind-${PV}.tar.bz2 \
            file://rpcbind.conf \
            file://rpcbind_add_option_to_fix_port_number.patch \
            file://0001-systemd-use-EnvironmentFile.patch \
+           file://CVE-2026-16277.patch \
           "
 SRC_URI[sha256sum] = "5613746489cae5ae23a443bb85c05a11741a5f12c8f55d2bb5e83b9defeee8de"