CVE-2024-26458

What it actually does

Memory leak in krb5 RPC portmapper implementation allows remote unauthenticated attackers to obtain partial memory contents over the network.

Why it matters to the business

Older Ubuntu Linux deployments remain exposed to low-severity information leakage; the issue affects many long-supported kernel packages but shows negligible exploitation activity and no ransomware usage.

How an attack unfolds

An attacker locates a reachable Kerberos RPC endpoint on an unpatched system and sends crafted remote procedure calls that trigger the leak in pmap_rmt.c, allowing inspection of returned memory fragments for sensitive data such as keys or credentials.

How to fix it

Upgrade affected packages to the listed fixed versions (for example linux 5.4.0-9.12 on Ubuntu 20.04 LTS, linux 4.15.0-1001.1 on Ubuntu 18.04 LTS, or equivalent fixes for 16.04 LTS and 14.04 LTS variants) and restart dependent services.

How to confirm the fix worked

Compare installed package versions against the per-flavor fixed releases; confirm absence of the vulnerable pmap_rmt.c code path via source inspection or vendor advisories.

Typical attack path

1. Scan for exposed krb5 RPC services on target networks
2. Send specially crafted portmapper requests to trigger allocation without corresponding free
3. Capture and parse response data for reusable sensitive information

How to detect it

Review network logs and system call traces for repeated or malformed RPC portmapper traffic to krb5 processes; correlate with memory-usage anomalies on long-running services.

What your security team should do

• Apply the exact fixed package versions for each Ubuntu release in use
• Prioritize remediation on internet-facing or high-value systems despite low EPSS
• Remove or isolate unsupported 14.04/16.04 deployments that cannot receive updates