CVE-2017-8779 Denial of service in n/a

High 7.5 Published 4 May 2017 Updated 5 Aug 2024

Remote attackers can cause denial of service via memory exhaustion by sending crafted UDP packets to rpcbind or related RPC libraries.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-8779?

CVE-2017-8779 is a high-severity denial of service vulnerability in n/a, published on 4 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.

Weakness: CWE-770

Which versions are affected by CVE-2017-8779?

It affects 3 products.

Linux distribution packages (40)

`calamari-server` Red Hat:ceph_storage:2::el7	All versions	`0:1.5.6-2.el7cp`
`ceph` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`ceph-base` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`ceph-common` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`ceph-fuse` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`ceph-iscsi-cli` Red Hat:ceph_storage:2::el7	All versions	`0:2.0-5.el7cp`
`ceph-iscsi-config` Red Hat:ceph_storage:2::el7	All versions	`0:2.0-4.el7cp`
`ceph-iscsi-tools` Red Hat:ceph_storage:2::el7	All versions	`0:2.0-3.el7cp`
`ceph-mds` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`ceph-mon` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`ceph-osd` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`ceph-radosgw` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`ceph-selinux` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`ceph-test` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`libcephfs1` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`libcephfs1-devel` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`libntirpc` Red Hat:ceph_storage:2::el7	All versions	`0:1.4.3-2.el7`
`libntirpc-debuginfo` Red Hat:ceph_storage:2::el7	All versions	`0:1.4.3-2.el7`
`librados2` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`librados2-devel` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`librbd1` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`librbd1-devel` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`librgw2` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`librgw2-devel` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`libtcmu` Red Hat:ceph_storage:2::el7	All versions	`0:1.2.1-0.2.20170104.git3d33566.el7cp`
`nfs-ganesha` Red Hat:ceph_storage:2::el7	All versions	`0:2.4.5-7.el7cp`
`nfs-ganesha-debuginfo` Red Hat:ceph_storage:2::el7	All versions	`0:2.4.5-7.el7cp`
`nfs-ganesha-rgw` Red Hat:ceph_storage:2::el7	All versions	`0:2.4.5-7.el7cp`
`pcp-pmda-lio` Red Hat:ceph_storage:2::el7	All versions	`0:1.0-2.el7cp`
`python-cephfs` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`python-crypto` Red Hat:ceph_storage:2::el7	All versions	`0:2.6.1-1.2.el7cp`
`python-crypto-debuginfo` Red Hat:ceph_storage:2::el7	All versions	`0:2.6.1-1.2.el7cp`
`python-flask` Red Hat:ceph_storage:2::el7	All versions	`1:0.10.1-5.el7`
`python-itsdangerous` Red Hat:ceph_storage:2::el7	All versions	`0:0.23-1.el7`
`python-jinja2` Red Hat:ceph_storage:2::el7	All versions	`0:2.7.2-2.el7cp`
`python-rados` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`python-rbd` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`
`python-rtslib` Red Hat:ceph_storage:2::el7	All versions	`0:2.1.fb64-0.1.20170301.git3637171.el7cp`
`python-werkzeug` Red Hat:ceph_storage:2::el7	All versions	`0:0.9.1-1.el7`
`rbd-mirror` Red Hat:ceph_storage:2::el7	All versions	`1:10.2.7-27.el7cp`

Products include Libtirpc Project Libtirpc, Ntirpc Project Ntirpc, Rpcbind Project Rpcbind.

How do I fix CVE-2017-8779?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-8779 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-8779 exists.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Sources

Also known as ALPINE-CVE-2017-8779, DEBIAN-CVE-2017-8779, DLA-936-1, DLA-937-1, DSA-3845-1, GHSA-fr7x-wc8q-h255 and 16 more.