CVE-2022-26496

Published: 6 March 2022

In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name.

Priority

CVSS 3 base score: 9.8

Status

Package	Release	Status
nbd Launchpad, Ubuntu, Debian	bionic	Released (1:3.16.2-1ubuntu0.2)
	focal	Released (1:3.20-1ubuntu0.1)
	impish	Released (1:3.21-1ubuntu0.1)
	jammy	Released (1:3.23-3ubuntu1)
	trusty	Needs triage
	upstream	Needs triage
	xenial	Needs triage

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26496
https://lists.debian.org/nbd/2022/01/msg00036.html
https://lists.debian.org/nbd/2022/01/msg00037.html
https://sourceforge.net/projects/nbd/files/nbd/
https://ubuntu.com/security/notices/USN-5323-1
NVD
Launchpad
Debian

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006915

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›