PublicDateAtUSN: 2022-03-06 06:15:00 UTC
Candidate: CVE-2022-26496
PublicDate: 2022-03-06 06:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26496
 https://lists.debian.org/nbd/2022/01/msg00036.html
 https://lists.debian.org/nbd/2022/01/msg00037.html
 https://sourceforge.net/projects/nbd/files/nbd/
 https://ubuntu.com/security/notices/USN-5323-1
Description:
 In nbd-server in nbd before 3.24, there is a stack-based buffer overflow.
 An attacker can cause a buffer overflow in the parsing of the name field by
 sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as
 the length of the name.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006915
Priority: medium
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]


Patches_nbd:
 upstream: https://sourceforge.net/p/nbd/code/ci/3740ff7fc9c3847d309c180a1a9fc9bc895342d5/
upstream_nbd: needs-triage
trusty/esm_nbd: needs-triage
esm-infra/xenial_nbd: needs-triage
trusty_nbd: ignored (out of standard support)
xenial_nbd: ignored (out of standard support)
bionic_nbd: released (1:3.16.2-1ubuntu0.2)
focal_nbd: released (1:3.20-1ubuntu0.1)
impish_nbd: released (1:3.21-1ubuntu0.1)
jammy_nbd: released (1:3.23-3ubuntu1)
devel_nbd: released (1:3.23-3ubuntu1)