Description
In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will cause a zero-sized buffer to be allocated for the name, resulting in a write to a dangling pointer. This issue exists for the NBD_OPT_INFO, NBD_OPT_GO, and NBD_OPT_EXPORT_NAME messages.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nbd | 1:3.24-1 | — |
| Debian 13 | nbd | 1:3.24-1 | — |
| Debian 12 | nbd | 1:3.24-1 | — |
| Debian 11 | nbd | 1:3.21-1+deb11u1 | DSA-5100-1 |
| Debian 10 | nbd | 1:3.19-3+deb10u1 | DSA-5100-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | nbd | 1:3.15.2-3+deb9u1 | DLA-2944-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | nbd | 1:3.23-3ubuntu1 | — |
| Ubuntu 20.04 LTS | nbd | 1:3.20-1ubuntu0.1 | USN-5323-1 |
| Ubuntu 18.04 LTS | nbd | 1:3.16.2-1ubuntu0.2 | USN-5323-1 |
| Ubuntu 16.04 LTS | nbd | No fix yet | — |
| Ubuntu 14.04 LTS | nbd | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nbd | 3.24-1.1 | openSUSE-SU-2024:11993-1 |
| openSUSE Leap 15.3 | nbd | 3.24-150000.3.3.1 | SUSE-SU-2022:1276-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nbd | 3.24-r0 | — |
| Alpine v3.23 | nbd | 3.24-r0 | — |
| Alpine v3.22 | nbd | 3.24-r0 | — |
| Alpine v3.21 | nbd | 3.24-r0 | — |
| Alpine v3.20 | nbd | 3.24-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nbd | 3.24-r0 | — |
| Alpine v3.18 | nbd | 3.24-r0 | — |
| Alpine v3.17 | nbd | 3.24-r0 | — |
| Alpine v3.16 | nbd | 3.24-r0 | — |
Advisories 5
- USN-5323-1 nbd vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5100-1 nbd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2944-1 nbd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11993-1 nbd-3.24-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1276-1 Security update for nbd SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://lists.debian.org/nbd/2022/01/msg00037.html
- https://sourceforge.net/projects/nbd/files/nbd/
- [debian-lts-announce] 20220310 [SECURITY] [DLA 2944-1] nbd security update mailing-list
- DSA-5100 vendor-advisory
- FEDORA-2022-62adf9a1e0 vendor-advisory
- FEDORA-2022-807e431d5f vendor-advisory
- FEDORA-2022-263873fb70 vendor-advisory
- GLSA-202402-10 vendor-advisory