CVE-2021-3716: Low severity nbdkit vulnerability
A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBDOPTSTRUCTUREDREPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.
Other sources
https://nostarttls.secvuln.info/ pointed out a common implementation flaw in various SMTP and IMAP servers with regards to improperly caching plaintext state across the STARTTLS encryption boundary. It turns out that nbdkit has the same vulnerability in regards to the NBD protocol: an attacker is able to inject a plaintext NBDOPTSTRUCTUREDREPLY before proxying everything else a client sends to the server; if the server then acts on that plaintext request (as nbdkit did before this patch), then the server ends up sending structured replies to at least NBDCMDREAD, even though the client was not expecting them. The NBD spec has been recently tightened to declare the nbdkit behavior to be a security hole.
Depending on how the client handles unexpected structured replies, the attacker can use this to form a denial of service attack on the client, distinct from a trivial protocol downgrade attack. Please refer to the upstream announcement (comment#10) for additional details.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-3716?
CVE-2021-3716 is a vulnerability found in nbdkit that allows a MitM attacker to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying client requests to the server.
How does CVE-2021-3716 affect nbdkit?
CVE-2021-3716 affects nbdkit by improperly caching plaintext state across the STARTTLS encryption boundary, leading to potential termination of client connections.
What is the severity of CVE-2021-3716?
CVE-2021-3716 has a severity rating of 3.1 (low).
How can I fix CVE-2021-3716?
To fix CVE-2021-3716, upgrade nbdkit to version 1.24.6 or higher.
Where can I find more information about CVE-2021-3716?
You can find more information about CVE-2021-3716 at the following references: [link1], [link2], [link3].