Log in Start free

Vulnerability · Published Mar 6, 2022 · Assigned by mitre

CVE-2022-26496

Critical 9.8

In plain English

A critical-severity security flaw in the nbd package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.6%top 10.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20nbd3.24-r0ALPINE-CVE-2022-26496
Alpine:v3.21nbd3.24-r0ALPINE-CVE-2022-26496
Alpine:v3.22nbd3.24-r0ALPINE-CVE-2022-26496
Alpine:v3.23nbd3.24-r0ALPINE-CVE-2022-26496
Alpine:v3.24nbd3.24-r0ALPINE-CVE-2022-26496
Debian:12nbd1:3.24-1DEBIAN-CVE-2022-26496
Debian:13nbd1:3.24-1DEBIAN-CVE-2022-26496
Debian:14nbd1:3.24-1DEBIAN-CVE-2022-26496
Ubuntu:22.04:LTSnbd1:3.23-3ubuntu1UBUNTU-CVE-2022-26496

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References