A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libnbdUpgrade ocaml-libnbdUpgrade ocaml-libnbd-develUpgrade libnbd-develUpgrade libnbd-bash-completionUpgrade python3-libnbdUpgrade nbdfuse | May 8, 2024 | Sep 28, 2023 |
| Alpine Linux | — | Upgrade libnbd | Aug 22, 2024 | Sep 28, 2023 |
| Debian | — | Upgrade libnbd | May 15, 2025 | Sep 28, 2023 |
| Oracle_linux | — | Upgrade ocaml-libnbdUpgrade nbdfuseUpgrade ocaml-libnbd-develUpgrade python3-libnbdUpgrade libnbd-bash-completionUpgrade libnbd-develUpgrade libnbd | May 8, 2024 | Sep 21, 2023 |
| Redhat_linux | — | Upgrade libnbdUpgrade ocaml-libnbd-debuginfoUpgrade ocaml-libnbd-develUpgrade libnbd-develUpgrade libnbd-debugsourceUpgrade ocaml-libnbdUpgrade nbdfuse-debuginfoNo solution existsUpgrade nbdfuseUpgrade libnbd-bash-completionUpgrade python3-libnbd-debuginfoUpgrade libnbd-debuginfoUpgrade python3-libnbd | May 1, 2024 | Sep 28, 2023 |
| Suse | — | Upgrade libnbd-develUpgrade nbdfuseUpgrade libnbd-bash-completionUpgrade libnbdUpgrade libnbd0Upgrade python3-libnbd | Oct 30, 2023 | Sep 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub