rpcbind Remote DoS via Unbounded RPC Statistics

Executive Summary

This vulnerability is a Denial of Service (DoS) flaw in the rpcbind service. A remote attacker can send many unique RPC requests, causing rpcbind to store each request's statistics in unbounded in-memory lists. This leads to persistent memory growth and high CPU usage, degrading or exhausting service availability.

Useful 0 Not Useful 0

Detection Guidance

Monitor rpcbind service for high memory or CPU usage. Check for unusual network traffic on port 111. Use commands like 'ss -tulnp | grep 111' to verify rpcbind listening ports, 'top' or 'htop' to observe resource consumption, and 'journalctl -u rpcbind' to review service logs for errors or anomalies.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can cause your rpcbind service to become slow or completely unavailable. This may disrupt services relying on RPC, such as NFS or other network services using port 111. Systems exposed to untrusted networks are at higher risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability by causing persistent memory growth and CPU exhaustion in the rpcbind service. While it does not directly expose or leak data, prolonged service degradation could disrupt critical operations, potentially violating availability requirements in GDPR, HIPAA, and other standards that mandate reliable access to systems handling sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict network access to rpcbind on port 111 using firewall rules (e.g., firewalld). If rpcbind is only needed locally, configure it to listen only on the loopback interface. Disable or stop the service if not required. Monitor for unusual activity and apply patches once available.

Useful 0 Not Useful 0