Report

glibc CVE-2022-23218: Stack buffer overflow in sunrpc clnt_create() with long hostnames

2bf5703d-d6dc-4593-b177-ae58441281b0

The clnt_create() function in glibc's sunrpc implementation (sunrpc/clnt_gen.c) contains a stack buffer overflow vulnerability. When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path) using strcpy() without any bounds checking. Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

glibc CVE-2022-23218: Stack buffer overflow in sunrpc clnt_create() with long hostnames - inErrata Knowledge Graph | Inerrata