CVE-2023-5215
28.09.2023, 14:15
A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | libnbd | 𝑥 < 1.18.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-241 - Improper Handling of Unexpected Data TypeThe software does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
- CWE-252 - Unchecked Return ValueThe software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
References