Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

Overview

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.

Affected

• libtirpc (all versions)
• libtirpc (all versions)
• libtirpc (all versions)
• libtirpc (all versions)
• libtirpc (all versions)
• libtirpc (all versions)
• openshift/ose-rhel-coreos-8 (all versions)
• openshift/ose-rhel-coreos-9 (all versions)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Workarounds

To mitigate this issue, avoid configuring applications that use pmap_getmaps() to query untrusted or attacker-controlled portmapper services. If such functionality is essential, restrict network access for services utilizing pmap_getmaps() to only trusted hosts via firewall rules. Additionally, consider isolating client applications that call pmap_getmaps() into constrained environments to limit the impact of potential resource exhaustion.