Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-5215
HistorySep 28, 2023 - 12:00 a.m.

CVE-2023-5215

2023-09-2800:00:00
ubuntu.com
ubuntu.com
10
libnbd
server
block size
nbd spec
application crash
unintended behavior
bugzilla
redhat
nbd_get_size()
unix

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0

Percentile

10.3%

A flaw was found in libnbd. A server can reply with a block size larger
than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This
issue could lead to an application crash or other unintended behavior for
NBD clients that doesn’t treat the return value of the nbd_get_size()
function correctly.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlibnbd< anyUNKNOWN
ubuntu22.04noarchlibnbd< anyUNKNOWN
ubuntu24.04noarchlibnbd< anyUNKNOWN

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0

Percentile

10.3%