CVE-2022-26496
moderate-risk
Published 2022-03-06
In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name.
Do I need to act?
-
0.47% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: ca2b9b33890e430a76b57f83cdabe80c64b12829
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (6)
Affected Vendors
References (18)
Mailing List
https://lists.debian.org/nbd/2022/01/msg00036.html
Third Party Advisory
https://www.debian.org/security/2022/dsa-5100
Mailing List
https://lists.debian.org/nbd/2022/01/msg00036.html
Third Party Advisory
https://www.debian.org/security/2022/dsa-5100
47
/ 100
moderate-risk
Severity
32/34 · Critical
Exploitability
2/34 · Minimal
Exposure
13/34 · Low