Libnbd
Monthly
Argument injection in libnbd's SSH transport allows an attacker who persuades a libnbd-using application or user to open a crafted NBD URI to run arbitrary commands with the privileges of the user running libnbd. The flaw affects libnbd builds that support nbd+ssh:// style connections and triggers when the hostname component of the URI begins with '-o', so the spawned ssh process interprets it as a command-line option instead of a host. There is no public exploit identified at time of analysis and no CISA KEV listing; exploitation remains gated by user interaction (a victim process must be induced to open the crafted URI), EPSS is low at 0.14% (3rd percentile), and Red Hat scores it 4.8 while our independent assessment applies a higher-impact vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) given the full confidentiality, integrity and availability impact of command execution.
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A flaw was found in libnbd. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in the copying tool `nbdcopy` of libnbd. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
A flaw was found in libnbd 1.7.3. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Argument injection in libnbd's SSH transport allows an attacker who persuades a libnbd-using application or user to open a crafted NBD URI to run arbitrary commands with the privileges of the user running libnbd. The flaw affects libnbd builds that support nbd+ssh:// style connections and triggers when the hostname component of the URI begins with '-o', so the spawned ssh process interprets it as a command-line option instead of a host. There is no public exploit identified at time of analysis and no CISA KEV listing; exploitation remains gated by user interaction (a victim process must be induced to open the crafted URI), EPSS is low at 0.14% (3rd percentile), and Red Hat scores it 4.8 while our independent assessment applies a higher-impact vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) given the full confidentiality, integrity and availability impact of command execution.
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A flaw was found in libnbd. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in the copying tool `nbdcopy` of libnbd. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
A flaw was found in libnbd 1.7.3. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.