PT-2019-13855 · Nbd · Nbd

Dhananjay Arunesh · Published 2019-11-26 · Updated 2022-12-01 · CVE-2019-14842

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nbd (affected versions not specified)

Description The issue is related to the Structured reply feature of the newstyle NBD protocol, which allows the server to send a reply in chunks. A bounds check error due to signed/unsigned confusion can cause data under the server's control to be written to memory before the read buffer supplied by the client. If the read buffer is on the stack, this can allow the stack return address from nbd pread() to be modified, enabling arbitrary code execution under the server's control. If the buffer is on the heap, other memory objects before the buffer can be overwritten, usually leading to arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-681

Related Identifiers

CVE-2019-14842

Affected Products

Nbd

References · 7

• https://redhat.com/archives/libguestfs/2019-October/msg00060.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-14842 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-14842 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14842 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14842 · Vendor Advisory
• https://t.me/cvenotify/38831 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14842 · Note