The Internet: rpcbind "rpcbomb" CVE-2017-8779, CVE-2017-8804

ID H1:235016
Type hackerone
Reporter guido
Modified 2019-10-14T00:24:47


Description: this allowed an attacker to easily disrupt a remote system through excessive memory consumption.

Writeup: Demonstration video: (this video shows that the attack doesn't necessarily just crashes the rpcbind process, but that the entire system can slow down severely because it has to resort to swap memory, even if overcommit is enabled. This implies scope=changed in the CVSS. But I filled out unchanged to be consistent with the official assessment) CVSS score:

rpcbind/libtirpc: CVE-2017-8779;a=commit;h=dd9c7cf4f8f375c6d641b760d124650c418c2ce3 (patches by me) GLIBC: CVE-2017-8804