[OE-core][scarthgap][patch] rpcbind: Fix CVE-2026-16277

[OE-core][scarthgap][patch] rpcbind: Fix CVE-2026-16277

[Vijay Anusuri]

Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-16277
[2] https://security-tracker.debian.org/tracker/CVE-2026-16277

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 .../rpcbind/rpcbind/CVE-2026-16277.patch      | 34 +++++++++++++++++++
 .../recipes-extended/rpcbind/rpcbind_1.2.6.bb |  1 +
 2 files changed, 35 insertions(+)
 create mode 100644 meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch

diff --git a/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch b/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
new file mode 100644
index 0000000000..868e5c3f01
--- /dev/null
+++ b/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
@@ -0,0 +1,34 @@
+From bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d Mon Sep 17 00:00:00 2001
+From: Steve Dickson <steved@redhat.com>
+Date: Wed, 27 May 2026 11:42:11 -0400
+Subject: [PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist()
+
+rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR strings into a fixed 128-byte stack buffer with sprintf(). A malicious or on-path rpcbind server overflows it when a user runs:
+rpcinfo -l <host> <prognum> <versnum>
+
+Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com>
+Signed-off-by: Steve Dickson <steved@redhat.com>
+
+Upstream-Status: Backport [https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d]
+CVE: CVE-2026-16277
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ src/rpcinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/rpcinfo.c b/src/rpcinfo.c
+index 0e14f78..43e8115 100644
+--- a/src/rpcinfo.c
++++ b/src/rpcinfo.c
+@@ -1120,7 +1120,7 @@ rpcbaddrlist (netid, argc, argv)
+ 
+ 	  re = &head->rpcb_entry_map;
+ 	  printf ("%10u%3u    ", parms.r_prog, parms.r_vers);
+-	  sprintf (buf, "%s/%s/%s ",
++	  snprintf (buf, sizeof(buf), "%s/%s/%s ",
+ 		   re->r_nc_protofmly, re->r_nc_proto,
+ 		   re->r_nc_semantics == NC_TPI_CLTS ? "clts" :
+ 		   re->r_nc_semantics == NC_TPI_COTS ? "cots" : "cots_ord");
+-- 
+2.43.0
+
diff --git a/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb b/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
index dbd4d32e0a..07e2f10c98 100644
--- a/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
+++ b/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
@@ -15,6 +15,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/rpcbind/rpcbind-${PV}.tar.bz2 \
            file://rpcbind.conf \
            file://rpcbind_add_option_to_fix_port_number.patch \
            file://0001-systemd-use-EnvironmentFile.patch \
+           file://CVE-2026-16277.patch \
           "
 SRC_URI[sha256sum] = "5613746489cae5ae23a443bb85c05a11741a5f12c8f55d2bb5e83b9defeee8de"
 
-- 
2.43.0

Re: [OE-core][scarthgap][patch] rpcbind: Fix CVE-2026-16277

[Fabien Thomas]

On Fri Aug 14, 2026 at 1:33 PM CEST, Vijay Anusuri via lists.openembedded.org wrote:
> Pick patch according to [2]
>
> [1] https://nvd.nist.gov/vuln/detail/CVE-2026-16277
> [2] https://security-tracker.debian.org/tracker/CVE-2026-16277
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
>  .../rpcbind/rpcbind/CVE-2026-16277.patch      | 34 +++++++++++++++++++
>  .../recipes-extended/rpcbind/rpcbind_1.2.6.bb |  1 +
>  2 files changed, 35 insertions(+)
>  create mode 100644 meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
>
> diff --git a/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch b/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
> new file mode 100644
> index 0000000000..868e5c3f01
> --- /dev/null
> +++ b/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
> @@ -0,0 +1,34 @@
> +From bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d Mon Sep 17 00:00:00 2001
> +From: Steve Dickson <steved@redhat.com>
> +Date: Wed, 27 May 2026 11:42:11 -0400
> +Subject: [PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist()
> +
> +rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR strings into a fixed 128-byte stack buffer with sprintf(). A malicious or on-path rpcbind server overflows it when a user runs:
> +rpcinfo -l <host> <prognum> <versnum>
> +
> +Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com>
> +Signed-off-by: Steve Dickson <steved@redhat.com>
> +
> +Upstream-Status: Backport [https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d]
> +CVE: CVE-2026-16277
> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> +---
> + src/rpcinfo.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/src/rpcinfo.c b/src/rpcinfo.c
> +index 0e14f78..43e8115 100644
> +--- a/src/rpcinfo.c
> ++++ b/src/rpcinfo.c
> +@@ -1120,7 +1120,7 @@ rpcbaddrlist (netid, argc, argv)
> + 
> + 	  re = &head->rpcb_entry_map;
> + 	  printf ("%10u%3u    ", parms.r_prog, parms.r_vers);
> +-	  sprintf (buf, "%s/%s/%s ",
> ++	  snprintf (buf, sizeof(buf), "%s/%s/%s ",
> + 		   re->r_nc_protofmly, re->r_nc_proto,
> + 		   re->r_nc_semantics == NC_TPI_CLTS ? "clts" :
> + 		   re->r_nc_semantics == NC_TPI_COTS ? "cots" : "cots_ord");
> +-- 
> +2.43.0
> +
> diff --git a/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb b/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
> index dbd4d32e0a..07e2f10c98 100644
> --- a/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
> +++ b/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
> @@ -15,6 +15,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/rpcbind/rpcbind-${PV}.tar.bz2 \
>             file://rpcbind.conf \
>             file://rpcbind_add_option_to_fix_port_number.patch \
>             file://0001-systemd-use-EnvironmentFile.patch \
> +           file://CVE-2026-16277.patch \
>            "
>  SRC_URI[sha256sum] = "5613746489cae5ae23a443bb85c05a11741a5f12c8f55d2bb5e83b9defeee8de"
>  
Hello Vijay,

Thanks for this patch, but the issue affects wrynose (1.2.8) as well.
This fix was merged upstream from 1.2.9 (yocto's master version).

Could you please submit a patch for the wrynose branch first?

Regards,
-- 
Fabien Thomas
Smile ECS

Re: [OE-core][scarthgap][patch] rpcbind: Fix CVE-2026-16277

[Vijay Anusuri]

[-- Attachment #1: Type: text/plain, Size: 4430 bytes --]

Hi Fabien,

Thanks for the reminder.

I've already submitted patches for the wrynose branch.

https://patchwork.yoctoproject.org/project/oe-core/patch/20260814095356.775418-1-vanusuri@mvista.com/
https://patchwork.yoctoproject.org/project/oe-core/patch/20260814095356.775418-2-vanusuri@mvista.com/

Thanks & Regards,
Vijay

On Fri, Aug 21, 2026 at 4:33 PM Fabien Thomas via lists.openembedded.org
<fabien.thomas=smile.fr@lists.openembedded.org> wrote:

> On Fri Aug 14, 2026 at 1:33 PM CEST, Vijay Anusuri via
> lists.openembedded.org wrote:
> > Pick patch according to [2]
> >
> > [1] https://nvd.nist.gov/vuln/detail/CVE-2026-16277
> > [2] https://security-tracker.debian.org/tracker/CVE-2026-16277
> >
> > Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > ---
> >  .../rpcbind/rpcbind/CVE-2026-16277.patch      | 34 +++++++++++++++++++
> >  .../recipes-extended/rpcbind/rpcbind_1.2.6.bb |  1 +
> >  2 files changed, 35 insertions(+)
> >  create mode 100644
> meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
> >
> > diff --git a/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
> b/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
> > new file mode 100644
> > index 0000000000..868e5c3f01
> > --- /dev/null
> > +++ b/meta/recipes-extended/rpcbind/rpcbind/CVE-2026-16277.patch
> > @@ -0,0 +1,34 @@
> > +From bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d Mon Sep 17 00:00:00 2001
> > +From: Steve Dickson <steved@redhat.com>
> > +Date: Wed, 27 May 2026 11:42:11 -0400
> > +Subject: [PATCH] rpcinfo: stack buffer overflow in rpcinfo
> rpcbaddrlist()
> > +
> > +rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR
> strings into a fixed 128-byte stack buffer with sprintf(). A malicious or
> on-path rpcbind server overflows it when a user runs:
> > +rpcinfo -l <host> <prognum> <versnum>
> > +
> > +Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com>
> > +Signed-off-by: Steve Dickson <steved@redhat.com>
> > +
> > +Upstream-Status: Backport [
> https://git.linux-nfs.org/?p=steved/rpcbind.git;a=commitdiff;h=bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d
> ]
> > +CVE: CVE-2026-16277
> > +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > +---
> > + src/rpcinfo.c | 2 +-
> > + 1 file changed, 1 insertion(+), 1 deletion(-)
> > +
> > +diff --git a/src/rpcinfo.c b/src/rpcinfo.c
> > +index 0e14f78..43e8115 100644
> > +--- a/src/rpcinfo.c
> > ++++ b/src/rpcinfo.c
> > +@@ -1120,7 +1120,7 @@ rpcbaddrlist (netid, argc, argv)
> > +
> > +       re = &head->rpcb_entry_map;
> > +       printf ("%10u%3u    ", parms.r_prog, parms.r_vers);
> > +-      sprintf (buf, "%s/%s/%s ",
> > ++      snprintf (buf, sizeof(buf), "%s/%s/%s ",
> > +                re->r_nc_protofmly, re->r_nc_proto,
> > +                re->r_nc_semantics == NC_TPI_CLTS ? "clts" :
> > +                re->r_nc_semantics == NC_TPI_COTS ? "cots" :
> "cots_ord");
> > +--
> > +2.43.0
> > +
> > diff --git a/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
> b/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
> > index dbd4d32e0a..07e2f10c98 100644
> > --- a/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
> > +++ b/meta/recipes-extended/rpcbind/rpcbind_1.2.6.bb
> > @@ -15,6 +15,7 @@ SRC_URI =
> "${SOURCEFORGE_MIRROR}/rpcbind/rpcbind-${PV}.tar.bz2 \
> >             file://rpcbind.conf \
> >             file://rpcbind_add_option_to_fix_port_number.patch \
> >             file://0001-systemd-use-EnvironmentFile.patch \
> > +           file://CVE-2026-16277.patch \
> >            "
> >  SRC_URI[sha256sum] =
> "5613746489cae5ae23a443bb85c05a11741a5f12c8f55d2bb5e83b9defeee8de"
> >
> Hello Vijay,
>
> Thanks for this patch, but the issue affects wrynose (1.2.8) as well.
> This fix was merged upstream from 1.2.9 (yocto's master version).
>
> Could you please submit a patch for the wrynose branch first?
>
> Regards,
> --
> Fabien Thomas
> Smile ECS
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#243922):
> https://lists.openembedded.org/g/openembedded-core/message/243922
> Mute This Topic: https://lists.openembedded.org/mt/120747221/7301997
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> vanusuri@mvista.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

[-- Attachment #2: Type: text/html, Size: 7168 bytes --]

Re: [OE-core][scarthgap][patch] rpcbind: Fix CVE-2026-16277

[Fabien Thomas]

Vijay,

Thank you for this contribution ! 
Sorry, I had missed that version bump...

I took a quick look at the upstream project.
There is only few "fix memory leak" between 1.28 and 1.29 so LGTM for
upgrading on wrynose stable. Next time but don't hesitate to explain 
what motivates you to choose a bump over a backport.

Thanks.
-- 
Fabien Thomas
Smile ECS

Re: [OE-core][scarthgap][patch] rpcbind: Fix CVE-2026-16277

[Vijay Anusuri]

[-- Attachment #1: Type: text/plain, Size: 733 bytes --]

Hi Fabien,

Thank you for reviewing the patch and for your feedback.

Understood. I'll make sure to include the reason for choosing a version
bump over a backport in the submission comments in the future.


Thanks & Regards,

Vijay


On Fri, Aug 21, 2026 at 6:32 PM Fabien Thomas <fabien.thomas@smile.fr>
wrote:

> Vijay,
>
> Thank you for this contribution !
> Sorry, I had missed that version bump...
>
> I took a quick look at the upstream project.
> There is only few "fix memory leak" between 1.28 and 1.29 so LGTM for
> upgrading on wrynose stable. Next time but don't hesitate to explain
> what motivates you to choose a bump over a backport.
>
> Thanks.
> --
> Fabien Thomas
> Smile ECS
>
>

[-- Attachment #2: Type: text/html, Size: 1241 bytes --]