Pick patch according to [2] [1] https://nvd.nist.gov/vuln/detail/CVE-2026-16277 [2] https://security-tracker.debian.org/tracker/CVE-2026-16277
Signed-off-by: Vijay Anusuri <[email protected]> --- .../rpcbind/rpcbind/CVE-2026-16277.patch | 34 +++++++++++++++++++ .../recipes-extended/rpcbind/rpcbind_1.2.6.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch diff --git a/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch b/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch new file mode 100644 index 0000000000..868e5c3f01 --- /dev/null +++ b/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch @@ -0,0 +1,34 @@ +From bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d Mon Sep 17 00:00:00 2001 +From: Steve Dickson <[email protected]> +Date: Wed, 27 May 2026 11:42:11 -0400 +Subject: [PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist() + +rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR strings into a fixed 128-byte stack buffer with sprintf(). A malicious or on-path rpcbind server overflows it when a user runs: +rpcinfo -l <host> <prognum> <versnum> + +Reported-by: Michalis Vasileiadis <[email protected]> +Signed-off-by: Steve Dickson <[email protected]> + +Upstream-Status: Backport [https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d] +CVE: CVE-2026-16277 +Signed-off-by: Vijay Anusuri <[email protected]> +--- + src/rpcinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/rpcinfo.c b/src/rpcinfo.c +index 0e14f78..43e8115 100644 +--- a/src/rpcinfo.c ++++ b/src/rpcinfo.c +@@ -1120,7 +1120,7 @@ rpcbaddrlist (netid, argc, argv) + + re = &head->rpcb_entry_map; + printf ("%10u%3u ", parms.r_prog, parms.r_vers); +- sprintf (buf, "%s/%s/%s ", ++ snprintf (buf, sizeof(buf), "%s/%s/%s ", + re->r_nc_protofmly, re->r_nc_proto, + re->r_nc_semantics == NC_TPI_CLTS ? "clts" : + re->r_nc_semantics == NC_TPI_COTS ? "cots" : "cots_ord"); +-- +2.43.0 + diff --git a/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb b/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb index dbd4d32e0a..07e2f10c98 100644 --- a/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb +++ b/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb @@ -15,6 +15,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/rpcbind/rpcbind-${PV}.tar.bz2 \ file://rpcbind.conf \ file://rpcbind_add_option_to_fix_port_number.patch \ file://0001-systemd-use-EnvironmentFile.patch \ + file://CVE-2026-16277.patch \ " SRC_URI[sha256sum] = "5613746489cae5ae23a443bb85c05a11741a5f12c8f55d2bb5e83b9defeee8de" -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243447): https://lists.openembedded.org/g/openembedded-core/message/243447 Mute This Topic: https://lists.openembedded.org/mt/120747221/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
