CVE-2015-7236

Vulnerability

A use-after-free vulnerability exists in the xprt_set_caller function within rpcb_svc_com.c of rpcbind version 0.2.1 and earlier [1][2]. The bug occurs when a netbuf structure is shallow-copied, causing two netbuf structures to share a pointer to the same address buffer [1]. When one netbuf is freed, the other retains a dangling reference to the freed memory region [1][2]. The vulnerable code path is triggered by processing a PMAP_CALLIT RPC request [2].

Exploitation

An attacker can trigger the vulnerability by sending a crafted PMAP_CALLIT packet over UDP to an rpcbind service that is listening on the network [2][4]. No authentication is required, and no user interaction is needed [1][2]. The attack does not require any special network position beyond being able to send UDP packets to the target host [2]. The exploit sequence involves a PMAP_CALLIT call that causes rpcbind to duplicate the caller's address into a netbuf, then forward the call, and upon reply, free the netbuf without clearing the copy in the transport handle [2]. Subsequent incoming UDP packets reuse the freed buffer, leading to memory corruption and eventual crash [2].

Impact

Successful exploitation results in a use-after-free condition that causes rpcbind to crash (denial of service) [1][2][3][4]. The impact is limited to denial of service; available references do not indicate that the vulnerability can be leveraged for remote code execution or information disclosure [4]. The crash can be triggered repeatedly by an attacker, effectively disabling the RPC service on the affected host [1].

Mitigation

FreeBSD released patches as part of advisory FreeBSD-SA-15:24 [1]. Corrected versions are 10.2-RELEASE-p5, 10.1-RELEASE-p22, and 9.3-RELEASE-p28 [1]. Users should update their rpcbind installation to a fixed version. No workaround is mentioned in the available references. If no official patch is available for other platforms (e.g., some Linux distributions), the system should be protected by controlling network access to rpcbind (typically UDP port 111) via firewall rules [2][4].