Vulnerabilities > CVE-2021-46828 - Infinite Loop vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

libtirpc-project

debian

CWE-835

NVD

Published: 2022-07-20

Updated: 2023-11-07

Summary

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Vulnerable Configurations

Part	Description	Count
Application	Libtirpc_Project Libtirpc Project Libtirpc 0.0.9 Libtirpc Project Libtirpc 0.0.10 Libtirpc Project Libtirpc 0.1.8 Libtirpc Project Libtirpc 0.1.9 Libtirpc Project Libtirpc 0.1.10 Libtirpc Project Libtirpc 0.1.11 Libtirpc Project Libtirpc 0.2.0 Libtirpc Project Libtirpc 0.2.1 Libtirpc Project Libtirpc 0.2.2 Libtirpc Project Libtirpc 0.2.3 Libtirpc Project Libtirpc 0.2.4 Libtirpc Project Libtirpc 0.2.5 Libtirpc Project Libtirpc 0.2.6 Libtirpc Project Libtirpc 0.3.0 Libtirpc Project Libtirpc 0.3.1 Libtirpc Project Libtirpc 0.3.2 Libtirpc Project Libtirpc 0.3.3 Libtirpc Project Libtirpc 1.0.1 Libtirpc Project Libtirpc 1.0.2 Libtirpc Project Libtirpc 1.0.3 Libtirpc Project Libtirpc 1.0.4 Libtirpc Project Libtirpc 1.1.4 Libtirpc Project Libtirpc 1.1.5	69
OS	Debian Debian Debian Linux 10.0 Debian Debian Linux 11.0	2

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References