PT-2022-7313 · Libtirpc+9 · Libtirpc+9

Published 2022-07-20 · Updated 2025-08-28 · CVE-2021-46828

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libtirpc versions prior to 1.3.3rc1

Description The issue is related to the mishandling of idle TCP connections, which can lead to the exhaustion of file descriptors of a process that uses libtirpc. This can cause an svc run infinite loop without accepting new connections, resulting in a denial of service. Remote attackers could exploit this issue.

Recommendations For libtirpc versions prior to 1.3.3rc1, update to version 1.3.3rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable process to minimize the risk of exploitation.

Fix

Improper Handling of Exceptional Conditions

Infinite Loop

Weakness Enumeration

CWE-755

CWE-835

Related Identifiers

ALSA-2022:8400

ALT-PU-2022-2359

ALT-PU-2022-2547

ALT-PU-2024-13287

BDU:2024-02624

CVE-2021-46828

DLA-3071-1

DSA-5200-1

MGASA-2022-0288

OESA-2022-1795

OPENSUSE-SU-2022_3305-1

OPENSUSE-SU-2024:12278-1

RHSA-2022:8400

RHSA-2022_8400

RLSA-2022:8400

SUSE-SU-2022:2991-1

SUSE-SU-2022:3305-1

SUSE-SU-2022:3791-1

SUSE-SU-2022_2991-1

SUSE-SU-2022_3305-1

SUSE-SU-2022_3791-1

USN-5538-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Libtirpc

References · 52

• https://cve.org/CVERecord?id=CVE-2021-46828 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46828 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2991-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5200 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02624 · Security Note
• https://osv.dev/vulnerability/RLSA-2022:8400 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0288 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0288.html · Security Note
• https://ubuntu.com/security/notices/USN-5538-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-46828 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5538-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46828 · Security Note
• https://osv.dev/vulnerability/DLA-3071-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46828 · Vendor Advisory