CVE-2022-26495: Buffer Overflow
In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will cause a zero-sized buffer to be allocated for the name, resulting in a write to a dangling pointer. This issue exists for the NBDOPTINFO, NBDOPTGO, and NBDOPTEXPORTNAME messages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nbdto a version that resolves this vulnerability.Fixed in 1:3.24-1Fixed in 1:3.21-1+deb11u1Fixed in 1:3.19-3+deb10u1 - Upgrade
Upgrade
debian/nbdto a version that resolves this vulnerability.Fixed in 1:3.24-1.1Fixed in 1:3.26.1-6.1Fixed in 1:3.27.1-4 - Upgrade
Upgrade
alpine/nbdto a version that resolves this vulnerability.Fixed in 3.24-r0 - Upgrade
Upgrade
debian/nbdto a version that resolves this vulnerability.Fixed in 1:3.24-1
Event History
Frequently Asked Questions
What is CVE-2022-26495?
CVE-2022-26495 is a vulnerability in nbd-server in nbd before version 3.24 that allows an attacker to trigger a heap-based buffer overflow through an integer overflow.
What is the severity of CVE-2022-26495?
CVE-2022-26495 has a severity rating of 9.8 (Critical).
How does CVE-2022-26495 affect the NBD server in nbd?
CVE-2022-26495 affects nbd-server in nbd versions before 3.24, allowing an attacker to trigger a heap-based buffer overflow.
What software versions are affected by CVE-2022-26495?
CVE-2022-26495 affects nbd versions up to and including 3.23.
How can I fix CVE-2022-26495?
To fix CVE-2022-26495, update your nbd package to version 3.24 or higher.