CVE-2015-7236

What it actually does

Use-after-free in xprt_set_caller allows remote unauthenticated attackers to trigger a crash of the rpcbind daemon by sending specially crafted PMAP_CALLIT packets over the network.

Why it matters to the business

Systems relying on RPC services experience sudden daemon crashes and loss of availability, leading to operational disruption for networked applications and services until the process is restarted.

How an attack unfolds

An attacker sends a sequence of crafted RPC packets containing PMAP_CALLIT requests that trigger the use-after-free condition in the rpcbind service, causing the daemon to crash and resulting in denial of service.

How to fix it

Upgrade affected packages to the fixed versions: libgit2 on Alpine v3.10/v3.11 to 0.25.1-r0 and on Alpine v3.4 to 0.24.6-r0; apply vendor patches for rpcbind 0.2.2 or later where applicable.

How to confirm the fix worked

Confirm rpcbind version is updated beyond 0.2.1, test that crafted PMAP_CALLIT packets no longer cause crashes, and verify service stability under load.

Typical attack path

1. Identify exposed rpcbind service on the network
2. Craft and send PMAP_CALLIT RPC packets to trigger the use-after-free
3. Observe daemon crash and loss of RPC functionality

How to detect it

Review system and daemon logs for unexpected rpcbind crashes or restarts following RPC traffic; correlate with network captures showing PMAP_CALLIT requests.

What your security team should do

• Prioritize patching rpcbind and dependent packages to the listed fixed versions
• Restrict network exposure of rpcbind to trusted hosts only
• Monitor for repeated RPC service restarts in logs