PT-2022-2044 · Nbd+6 · Nbd+6

王多 · Published 2022-03-06 · Updated 2024-11-15 · CVE-2022-26496

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions nbd versions prior to 3.24

Description The issue is related to a stack-based buffer overflow in the nbd-server. An attacker can cause a buffer overflow by sending a crafted NBD OPT INFO or NBD OPT GO message with a large value as the length of the name field. This could potentially allow a remote attacker to execute arbitrary code.

Recommendations For versions prior to 3.24, update to version 3.24 or later to resolve the issue. As a temporary workaround, consider restricting access to the nbd-server to minimize the risk of exploitation. Avoid using large values for the name field in NBD OPT INFO or NBD OPT GO messages until the issue is resolved.

Exploit

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

ALT-PU-2024-15569

ALT-PU-2024-15571

ALT-PU-2024-1889

ALT-PU-2024-2449

BDU:2022-01643

CVE-2022-26496

DSA-5100-1

MGASA-2022-0403

OPENSUSE-SU-2022_1276-1

SUSE-SU-2022:1276-1

USN-5323-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Os

Suse

Ubuntu

Nbd

References · 46

• 🔥 https://lists.debian.org/nbd/2022/01/msg00037.html · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU5JFD4PEJED72TZLZ5R2Q2SFXICU5I5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-26495 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5323-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26496 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0403 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/G2UPX62BIWOOHSACGUDB7E3O4URNN37F · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G2UPX62BIWOOHSACGUDB7E3O4URNN37F · Vendor Advisory
• https://debian.org/security/2022/dsa-5100 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-26496 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1276-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01643 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PU5JFD4PEJED72TZLZ5R2Q2SFXICU5I5 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5323-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0403.html · Security Note