Summary
Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients.
Security Fix(es):
* libnbd: Malicious NBD server may crash libnbd (CVE-2023-5871)
* libnbd: Crash or misbehaviour when NBD server returns an unexpected block size (CVE-2023-5215)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | libnbd | 1.18.1-3.el9 |
| AlmaLinux · 9 | libnbd-bash-completion | 1.18.1-3.el9 |
| AlmaLinux · 9 | libnbd-devel | 1.18.1-3.el9 |
| AlmaLinux · 9 | nbdfuse | 1.18.1-3.el9 |
| AlmaLinux · 9 | ocaml-libnbd | 1.18.1-3.el9 |
| AlmaLinux · 9 | ocaml-libnbd-devel | 1.18.1-3.el9 |
| AlmaLinux · 9 | python3-libnbd | 1.18.1-3.el9 |
Vulnerabilities 2
-
Medium 5.3
Libnbd: crash or misbehaviour when nbd server returns an unexpected block size
A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the retu…
-
Medium 5.3
Libnbd: malicious nbd server may crash libnbd
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.