Description
In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nbd | 1:3.24-1 | — |
| Debian 13 | nbd | 1:3.24-1 | — |
| Debian 12 | nbd | 1:3.24-1 | — |
| Debian 11 | nbd | 1:3.21-1+deb11u1 | DSA-5100-1 |
| Debian 10 | nbd | 1:3.19-3+deb10u1 | DSA-5100-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | nbd | 1:3.23-3ubuntu1 | — |
| Ubuntu 20.04 LTS | nbd | 1:3.20-1ubuntu0.1 | USN-5323-1 |
| Ubuntu 18.04 LTS | nbd | 1:3.16.2-1ubuntu0.2 | USN-5323-1 |
| Ubuntu 16.04 LTS | nbd | No fix yet | — |
| Ubuntu 14.04 LTS | nbd | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | nbd | 3.24-150000.3.3.1 | SUSE-SU-2022:1276-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nbd | 3.24-r0 | — |
| Alpine v3.23 | nbd | 3.24-r0 | — |
| Alpine v3.22 | nbd | 3.24-r0 | — |
| Alpine v3.21 | nbd | 3.24-r0 | — |
| Alpine v3.20 | nbd | 3.24-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nbd | 3.24-r0 | — |
| Alpine v3.18 | nbd | 3.24-r0 | — |
| Alpine v3.17 | nbd | 3.24-r0 | — |
| Alpine v3.16 | nbd | 3.24-r0 | — |
Advisories 3
- USN-5323-1 nbd vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5100-1 nbd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:1276-1 Security update for nbd SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://lists.debian.org/nbd/2022/01/msg00037.html
- https://sourceforge.net/projects/nbd/files/nbd/
- https://lists.debian.org/nbd/2022/01/msg00036.html
- DSA-5100 vendor-advisory
- FEDORA-2022-62adf9a1e0 vendor-advisory
- FEDORA-2022-807e431d5f vendor-advisory
- FEDORA-2022-263873fb70 vendor-advisory
- http://packetstormsecurity.com/files/172148/Shannon-Baseband-fmtp-SDP-Attribute-Memory-Corruption.html
- GLSA-202402-10 vendor-advisory