CVE-2019-14842
First published: Tue Nov 26 2019(Updated: )
Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed to test for chunk offsets smaller than the beginning of the request did not work because of signed/unsigned confusion. If one of these chunks contains a negative offset then data under control of the server is written to memory before the read buffer supplied by the client. If the read buffer is located on the stack then this allows the stack return address from nbd_pread() to be trivially modified, allowing arbitrary code execution under the control of the server. If the buffer is located on the heap then other memory objects before the buffer can be overwritten, which again would usually lead to arbitrary code execution.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Libnbd | <1.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-14842?
CVE-2019-14842 is a vulnerability in the Redhat Libnbd software that allows a server to send a reply in chunks, but a bounds check does not work properly, leading to a potential security issue.
What is the severity of CVE-2019-14842?
The severity of CVE-2019-14842 is critical with a severity value of 9.8.
How does CVE-2019-14842 affect Redhat Libnbd?
CVE-2019-14842 affects Redhat Libnbd versions up to and excluding 1.0.3.
Is there a fix for CVE-2019-14842?
Yes, a fix for CVE-2019-14842 is available. It is recommended to update to a version of Redhat Libnbd that is not affected by this vulnerability.
Where can I find more information about CVE-2019-14842?
More information about CVE-2019-14842 can be found at the following references: <a href='https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14842'>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14842</a> and <a href='https://www.redhat.com/archives/libguestfs/2019-October/msg00060.html'>https://www.redhat.com/archives/libguestfs/2019-October/msg00060.html</a>.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/redhat
- canonical/redhat libnbd