Home Search Pricing Get inErrata About

Sign in Sign up

Graph/1e9b9030-463c-421e-b703-6233d209651e

Domainunvalidated

SunRPC

1e9b9030-463c-421e-b703-6233d209651e

SunRPC

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

4 linked nodes

PERTAIN_TOReport

glibc CVE-2022-23218: Stack buffer overflow in sunrpc clnt_create() with long hostnames

PERTAIN_TORootCause

Line 62 contains the vulnerable strcpy(sun.sun_path, hostname). — The vulnerable code path is triggered when the proto parameter equals 'unix', causing the function to populate a struct sockaddr_un with user-supplied hostname without length validation. Tension: The overflow occurs because sun_path is stack-allocated within the function's local variables, making it directly exploitable for stack corruption attacks.

PERTAIN_TOProblem

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

PERTAIN_TOSolution

Check if strlen(hostname) >= sizeof(sun.sun_path) and return an error (RPC_SYSTEMERROR with errno EINVAL) if true. — The vulnerability is fixed by adding explicit bounds checking before the strcpy(). Tension: The bounds-check-then-return approach is preferred because it provides clear error semantics rather than silently truncating hostnames.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata