rpcbind still vulnerable with CVE-2017-8779

[Takeshi Hatae]

The site (https://ubuntu.com/security/CVE-2017-8779), indicates "Not Vulnerable" regarding environment
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable (0.2.3-0.6)

I'm using an NVIDIA Jetson AGX containing rpcbind on the environment.
$ apt list | grep rpcbind
rpcbind/bionic-updates,now 0.2.3-0.6ubuntu0.18.04.1 arm64 [installed]
$ cat /etc/os-release
NAME="Ubuntu"
VERSION="18.04.5 LTS (Bionic Beaver)"
ID=ubuntu

When I tried 'rpcbomb' attack with using Metasploit then found it was successfully done.
msf6 > use auxiliary/dos/rpc/rpcbomb
msf6 auxiliary(dos/rpc/rpcbomb) > set RHOSTS <IPaddress>
msf6 auxiliary(dos/rpc/rpcbomb) > run

In other words rpcbind was caused memory consumptions, which led to 43GB+ memory usage in the end.
I don't know if this is a bug or some degradation, but could be a vulnerability causing a DOS attack, so let me report it.

[Marc Deslauriers (mdeslaur)]

I can confirm the upstream patches for CVE-2017-8779, while solving the original issue, don't solve the issue caused by running the original exploit in a loop and doing small allocations until memory consumption grows to a large number. This no longer works in Focal, so we may need to investigate what changed in rpcbind and libtirpc to determine what to backport.

[Marc Deslauriers (mdeslaur)]

So the issue turned out to be the wrong patch was used in the bionic package.

I have uploaded a new package for bionic to the security team PPA here:

https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages

Could you possibly give it a try and comment here if it worked in your environment? If so, I'll release it as a security update.

Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package rpcbind - 0.2.3-0.6ubuntu0.18.04.2

---------------
rpcbind (0.2.3-0.6ubuntu0.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: DoS via memory consumption (LP: #1925280)
    - debian/patches/CVE-2017-8779.patch: pair all svc_getargs() calls with
      svc_freeargs() to avoid memory leak in src/pmap_svc.c,
      src/rpcb_svc.c, src/rpcb_svc_4.c, src/rpcb_svc_com.c.
    - debian/patches/CVE-2017-8779-2.patch: fix building without
      --enable-debug in src/pmap_svc.c.
    - The patch included in 0.2.3-0.6 did not correctly fix this issue.
    - CVE-2017-8779

 -- Marc Deslauriers <email address hidden> Tue, 08 Jun 2021 09:03:58 -0400

[Marc Deslauriers (mdeslaur)]

An update has now been published to fix this issue:

https://ubuntu.com/security/notices/USN-4986-1

Thanks!

[Takeshi Hatae (takeshi200ok)]

Hello Marc,

I confirmed the patch is perfectly working under the same test condition.
Thank you very much!

[Marc Deslauriers (mdeslaur)]

Thanks for reporting the issue!