CVE-2018-14621 Denial of service in libtirpc
An infinite loop in libtirpc allows remote attackers to exhaust file descriptors and cause a denial of service by consuming CPU resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-14621?
CVE-2018-14621 is a medium-severity denial of service vulnerability in [UNKNOWN] libtirpc, published on 30 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than select, exhaustion of file descriptors would cause the server to enter an infinite loop, consuming a large amount of CPU time and denying service to other clients until restarted.
Weakness: CWE-835
Which versions are affected by CVE-2018-14621?
It affects 1 product.
Products include Libtirpc Project Libtirpc.
How do I fix CVE-2018-14621?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-14621 being exploited?
There is no known exploitation of CVE-2018-14621 in the wild and no public exploit code.
Other vulnerabilities in [UNKNOWN] libtirpc
Sources
Also known as GHSA-362j-4wp6-47gj.