CVE-2022-26496: Buffer Overflow
In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBDOPTINFO or NBDOPTGO message with an large value as the length of the name.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-26496?
CVE-2022-26496 is a vulnerability in nbd-server in nbd before version 3.24, which allows an attacker to cause a stack-based buffer overflow.
How does CVE-2022-26496 occur?
CVE-2022-26496 occurs due to a buffer overflow in the parsing of the name field in nbd-server, triggered by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with a large value as the length of the name.
What is the severity of CVE-2022-26496?
The severity of CVE-2022-26496 is critical, with a CVSS score of 9.8.
Which software versions are affected by CVE-2022-26496?
CVE-2022-26496 affects nbd versions before 3.24, as well as Debian Linux 10.0, Debian Linux 11.0, Fedora 34, Fedora 35, and Fedora 36.
How can CVE-2022-26496 be fixed?
To fix CVE-2022-26496, update nbd to version 3.24 or later, and apply any relevant security patches provided by the operating system.