CVE-2022-0485: Medium severity redhat libnbd vulnerability
A flaw was found in nbdcopy. When copying from NBD server using the asynchronous copy mode (default) nbdcopy may create a corrupted destination image if read or write NBD command start but the server returns an error. nbdcopy also exits with zero exit code, so programs running it cannot detect that the operation failed.
Upstream patch proposed: https://listman.redhat.com/archives/libguestfs/2022-February/msg00039.html
Other sources
A flaw was found in the copying tool nbdcopy of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as successful, rather than checking the error parameter. This could result in the silent creation of a corrupted destination image.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libnbdto a version that resolves this vulnerability.Fixed in 1.11.8 - Upgrade
Upgrade
debian/libnbdto a version that resolves this vulnerability.Fixed in 1.14.2-1Fixed in 1.22.2-1Fixed in 1.24.4-1 - Upgrade
Upgrade
alpine/libnbdto a version that resolves this vulnerability.Fixed in 1.14.1-r0 - Upgrade
Upgrade
debian/libnbdto a version that resolves this vulnerability.Fixed in 1.10.5-1 - Configuration
Use nbdcopy with the --synchronous option to avoid undetected data corruption when copying from an NBD server; this may reduce performance by avoiding asynchronous operations.
nbdcopy --synchronous = enabled
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-0485?
CVE-2022-0485 is a vulnerability found in the copying tool `nbdcopy` of libnbd.
What is the severity of CVE-2022-0485?
The severity of CVE-2022-0485 is medium (4).
How does CVE-2022-0485 affect libnbd?
CVE-2022-0485 affects libnbd version 1.11.8 and earlier.
How can I fix CVE-2022-0485?
To fix CVE-2022-0485, update libnbd to version 1.11.8 or later.
What is the CWE ID of CVE-2022-0485?
The CWE ID of CVE-2022-0485 is CWE-252.