Description

rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-05T19:16:55.590Z",
  "pubdate": "2026-09-05T19:16:55.590Z",
  "executiveSummary": "The rpcapd daemon exhibits a significant memory leak vulnerability due to improper memory management during the processing of specific RPCAP messages.\nThis vulnerability is classified as an uncontrolled resource consumption issue, leading to persistent memory exhaustion.\nThe flaw affects the handling of RPCAP_MSG_UPDATEFILTER_REQ and RPCAP_MSG_STARTCAP_REQ request types.\nThe risk implication is a potential denial-of-service (DoS) condition, as the server will continuously consume system memory until it reaches exhaustion, forcing the process or the host system to crash or become unresponsive.\nThe attack is remotely exploitable, as an attacker can repeatedly send specifically crafted messages to the service to accelerate the memory depletion rate.\nNo authentication is necessarily required to trigger the leak, as the messages are part of the standard RPCAP protocol interaction flow, allowing any reachable client to impact service availability.\nThis vulnerability poses a high availability risk in environments where rpcapd is exposed to untrusted network segments.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper lifecycle management of heap-allocated memory buffers within the rpcapd process. When the server receives an RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message, the application allocates a memory buffer of up to 65536 bytes to store the incoming packet filter or capture configuration data.\nInvestigation of the source code reveals that while these allocations occur during the transition of protocol states or message processing, the corresponding 'free()' calls are omitted. Consequently, each valid request message results in a permanent loss of 64KB of memory within the daemon's address space. Over time, even standard operational traffic will lead to memory depletion; however, a malicious actor can expedite this by flooding the service with these specific request types.\nThe attack flow begins with the malicious client establishing a connection with the rpcapd service. Once connected, the attacker sends a sequence of RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ packets. Because the daemon fails to reclaim the memory allocated for these payloads, each packet incremented the process's resident set size (RSS). By sending these requests at a high frequency, the attacker can force the operating system to invoke the Out-Of-Memory (OOM) killer on the rpcapd process or induce a system-wide denial-of-service condition due to kernel-level memory pressure.\nThe vulnerable component is the message parser and request handler responsible for managing RPCAP session parameters. The issue is persistent regardless of the session state, as the leak occurs at the application layer before or during filter application. The vulnerability is network-exposed, as rpcapd is typically configured to listen on a designated port to accept remote capture requests. Because there is no mechanism to track and release these buffers upon session termination or message processing completion, the memory leak is deterministic and cumulative.\nThe impact of this exploit is limited to denial-of-service; there is no evidence that this memory leak can be repurposed for arbitrary code execution. However, the inability to manage these resources effectively renders the service inherently unstable under sustained load. In environments with strict resource constraints or limited swap space, the time-to-failure is significantly reduced, making this an effective vector for disrupting network monitoring infrastructure."
}