UBUNTU-CVE-2023-5215

A flaw was found in libnbd. A server can reply with a block size larger than 2^63 the NBD spec states the size is a 64-bit unsigned value. This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbdgetsize function...

libnbd Security Vulnerabilities

libnbd is a library for editing NBD Network Block Device clients. A security vulnerability exists in libnbd that stems from an inability to properly handle the return value of the nbdgetsize function, which could lead to application crashes or other unexpected behavior on the client...

PT-2023-9291 · Libnbd +5 · Libnbd +5

Name of the Vulnerable Software and Affected Versions: libnbd affected versions not specified Description: A flaw was found in libnbd where a server can reply with a block size larger than 2^63, which is a 64-bit unsigned value according to the NBD spec. This issue could lead to an application...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.13.3 security and bug fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.13.3 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS ba...

CVE-2023-34256

An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4groupdesccsum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend again...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.12.3 Security and Bug fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.12.3 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS bas...

kernel: md: Replace snprintf with scnprintf

In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf returns the number of characters generated from...

kernel: md: Replace snprintf with scnprintf

In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf returns the number of characters generated from...

kernel: drbd: only clone bio if we have a backing device

A NULL pointer dereference was found in the Linux kernel Distributed Replicated Block Device driver's I/O request handling. A local user with privileges to perform I/O operations on a DRBD block device can trigger I/O requests when the DRBD device is configured in diskless mode no local backing...

PT-2025-40121

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue was identified in the Linux kernel related to ext4 filesystem handling. A commit extended the transaction scope in ext4 unlink too far, including a call to ext4 find entry. This...

PT-2023-36111 · Drbd · Drbd

Name of the Vulnerable Software and Affected Versions: drbd affected versions not specified Description: The issue concerns a rebuild of the package with a new secure boot key. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2025-38025

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a use-after-free issue in the do rbd add function when rbd dev create fails. This occurs when ownership of structures like rbd dev-rbd client, rbd dev-spec, and...

PT-2025-38216

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.12.0-0 fbk12 clang 7346 g1bb6f2e7058f 1 Description The Linux kernel contains a flaw related to block device handling during polled I/O operations. Specifically, the code did not sufficiently check for a NULL...

K61547155: QEMU vulnerabilities CVE-2020-10761, CVE-2020-13361, CVE-2020-13362, CVE-2020-13659, and CVE-2020-13754

Security Advisory Description CVE-2020-10761 An assertion failure issue was found in the Network Block DeviceNBD Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remot...

SUSE CVE-2005-3534

Buffer overflow in the Network Block Device nbd server 2.7.5 and earlier, and 2.8.0 through 2.8.2, allows remote attackers to execute arbitrary code via a large request, which is written past the end of the buffer because nbd does not account for memory taken by the reply header...

SUSE CVE-2008-0928

Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine...

SUSE CVE-2011-0530

Buffer overflow in the mainloop function in nbd-server.c in the server in Network Block Device nbd before 2.9.20 might allow remote attackers to execute arbitrary code via a long request. NOTE: this issue exists because of a CVE-2005-3534 regression...

SUSE CVE-2011-1925

nbd-server.c in Network Block Device nbd-server 2.9.21 allows remote attackers to cause a denial of service NULL pointer dereference and crash by causing a negotiation failure, as demonstrated by specifying a name for a non-existent export...

SUSE CVE-2011-4127

The Linux kernel before 3.2.2 does not properly restrict SGIO ioctl calls, which allows local users to bypass intended restrictions on disk read and write operations by sending a SCSI command to 1 a partition block device or 2 an LVM volume...

SUSE CVE-2011-4132

The cleanupjournaltail function in the Journaling Block Device JBD functionality in the Linux kernel 2.6 allows local users to cause a denial of service assertion error and kernel oops via an ext3 or ext4 image with an "invalid log first block value."...