A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.

A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbdgetsize() function correctly.

A flaw was found in nbdcopy. When copying from NBD server using the asynchronous copy mode (default) nbdcopy may create a corrupted destination image if read or write NBD command start but the server returns an error. nbdcopy also exits with zero exit code, so programs running it cannot detect that the operation failed.

Upstream patch proposed: https://listman.redhat.com/archives/libguestfs/2022-February/msg00039.html

A flaw was found in libnbd 1.7.3. An assertion failure in nbdunlockedoptgo in ilb/opt.c may lead to denial of service.