An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service.

🗓️ 18 Aug 2020 00:00:00Reported by MicrosoftType

NBD server assertion failure before 5.0.1 lets remote clients crash near max request length.

Reporter	Title	Published	Views	Family All 59
BDU FSTEC	The vulnerability of the Network Block Device (NBD) emulator’s hardware emulation software, QEMU, stems from improper resource management by external emulators. This allows a malicious actor to trigger a service failure.	27 Oct 202100:00	–	bdu_fstec
CBLMariner	CVE-2020-10761 affecting package qemu-kvm 4.2.0-48	30 Nov 202019:31	–	cbl_mariner
Tenable Nessus	CentOS 9 : qemu-kvm-6.1.0-3.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : qemu (EulerOS-SA-2020-2320)	2 Nov 202000:00	–	nessus
Tenable Nessus	GLSA-202011-09 : QEMU: Multiple vulnerabilities	12 Nov 202000:00	–	nessus
Tenable Nessus	openSUSE Security Update : qemu (openSUSE-2020-1108)	30 Jul 202000:00	–	nessus
Tenable Nessus	Oracle Linux 7 : qemu (ELSA-2021-9034)	5 Feb 202100:00	–	nessus
Tenable Nessus	QEMU 4.2 < 5.1.0-rc0 Multiple Vulnerabilities	24 Jul 202000:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2020:2015-1)	27 Jul 202000:00	–	nessus
Tenable Nessus	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-4467-1)	20 Aug 202000:00	–	nessus