PT-2022-2040 · Nbd+6 · Nbd+6
王多
·
Published
2022-03-06
·
Updated
2024-11-15
·
CVE-2022-26495
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
nbd versions prior to 3.24
Description
The issue is related to an integer overflow in the implementation of network block devices (nbd), which can lead to a heap-based buffer overflow. This can be exploited by a remote attacker by sending specially crafted messages, including NBD OPT INFO, NBD OPT GO, and NBD OPT EXPORT NAME, allowing the execution of arbitrary code. A specific value of 0xffffffff in the name length field can cause a zero-sized buffer to be allocated, resulting in a write to a dangling pointer.
Recommendations
For versions prior to 3.24, update to version 3.24 or later to resolve the issue. As a temporary workaround, consider restricting access to the NBD OPT INFO, NBD OPT GO, and NBD OPT EXPORT NAME messages until a patch is available. Avoid using the
name length field with a value of 0xffffffff in the affected API endpoints until the issue is resolved.Exploit
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Nbd