Description
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than select, exhaustion of file descriptors would cause the server to enter an infinite loop, consuming a large amount of CPU time and denying service to other clients until restarted.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | libtirpc | 1.0.2-rc2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | libtirpc | 0.2.1-1.13.6.1 | SUSE-SU-2018:3146-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 11 SP4 | libtirpc | 0.2.1-1.13.6.1 | SUSE-SU-2018:3146-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | libtirpc +1 | 1.1.4-4.0.1.el8 | ELSA-2021-9449 |
Advisories 2
- SUSE-SU-2018:3146-1 Security update for libtirpc SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2021-9449 Important: libtirpc security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 14, 2021