CVE-2022-0485: Medium severity red hat libnbd vulnerability
A flaw was found in nbdcopy. When copying from NBD server using the asynchronous copy mode (default) nbdcopy may create a corrupted destination image if read or write NBD command start but the server returns an error. nbdcopy also exits with zero exit code, so programs running it cannot detect that the operation failed.
Upstream patch proposed: https://listman.redhat.com/archives/libguestfs/2022-February/msg00039.html
Other sources
A flaw was found in the copying tool nbdcopy of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as successful, rather than checking the error parameter. This could result in the silent creation of a corrupted destination image.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-0485?
CVE-2022-0485 is a vulnerability found in the copying tool `nbdcopy` of libnbd.
What is the severity of CVE-2022-0485?
The severity of CVE-2022-0485 is medium (4).
How does CVE-2022-0485 affect libnbd?
CVE-2022-0485 affects libnbd version 1.11.8 and earlier.
How can I fix CVE-2022-0485?
To fix CVE-2022-0485, update libnbd to version 1.11.8 or later.
What is the CWE ID of CVE-2022-0485?
The CWE ID of CVE-2022-0485 is CWE-252.