CVE-2026-16529: Pcp: pcp: denial of service due to signed integer overflow
A signed integer overflow in the PCP pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
Other sources
Summary: A signed integer overflow in pmGetPDU() (pdu.c:661) permanently corrupts the process-wide static variable maxsize, rendering the affected daemon unable to read any PDU for the remainder of its lifetime. No authentication or prior session state is required. When php->len = 0x7FFFFFFF, the expression PDUCHUNK (1 + php->len / PDUCHUNK) overflows to -2147483648. Every subsequent call to pmFindPDUBuf(maxsize) returns NULL, causing silent connection failures. Two attack vectors were confirmed: pmlogger TCP 4330 (conditional on PMLOGGERLOCAL being unset) and pmcd TCP 44321 during SASL negotiation. Prerequisites: Vector 1 (pmlogger TCP 4330): Default installation, no credentials required. Bound to loopback by default; remotely exploitable only if PMLOGGERLOCAL is unset. Vector 2 (pmcd TCP 44321): SASL configured (standard in major distro packages). Bound to loopback by default; remotely exploitable only if the operator altered the binding configuration.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pcpto a version that resolves this vulnerability.Fixed in 7.2.0-1 - Upgrade
Upgrade
debian/pcpto a version that resolves this vulnerability.Fixed in 7.2.2-1 - Compensating control
Ensure PMLOGGER_LOCAL remains unset only if you can enforce loopback-only exposure; otherwise bind pmlogger (TCP 4330) to loopback by default and do not allow remote access unless PMLOGGER_LOCAL is set/controlled as described.
- Compensating control
Ensure pmcd (TCP 44321) remains bound to loopback by default, and do not expose it remotely unless SASL is configured exactly as described; remote exploitation is possible only if the operator altered the binding and SASL negotiation occurs.
Event History
Frequently Asked Questions
Which services and network conditions are exposed?
The issue affects pmlogger on TCP port 4330 and pmcd on TCP port 44321 during SASL negotiation. Both are bound to loopback by default; remote exploitation requires PMLOGGER_LOCAL to be unset for pmlogger, while the pmcd remote-exposure condition is not fully provided.
Does exploitation require authentication or an existing session?
No. Crafted network packets can trigger the overflow without credentials, authentication, or prior session state.
What is required to reach the pmcd attack path?
The pmcd path is reached during SASL negotiation and requires SASL to be configured. The provided data states that SASL is standard in major distribution packages.
What happens after a successful attack?
The affected daemon is permanently unable to read subsequent PDUs for the remainder of its lifetime, causing silent connection failures and a total denial of service. The condition corrupts a process-wide static variable, so recovery requires restarting the affected daemon.