Vulnerability CVE-2022-26496
Published: 2022-03-06

Description:
In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name.

Type:

CWE-787

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Network block device project -> Network block device 

 References:
https://sourceforge.net/projects/nbd/files/nbd/
https://lists.debian.org/nbd/2022/01/msg00037.html
https://lists.debian.org/nbd/2022/01/msg00036.html
https://www.debian.org/security/2022/dsa-5100
Copyright 2024, cxsecurity.com

 

Back to Top