CVE catalog

CVE-2022-26495

nbd: CVE-2022-26495

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.86% · Oct 25, 2026

In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will cause a zero-sized buffer to be allocated for the name, resulting in a write to a dangling pointer. This issue exists for the NBD_OPT_INFO, NBD_OPT_GO, and NBD_OPT_EXPORT_NAME messages.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannbdsid1:3.27.1-4fixed
Debiannbdforky1:3.27.1-4fixed
Debiannbdtrixie1:3.26.1-6.1fixed
Debiannbdbookworm1:3.24-1.1fixed
Ubuntunbd18.041:3.15.2-3vulnerable
Ubuntunbd18.041:3.16.2-1vulnerable
Ubuntunbd18.041:3.16.2-1ubuntu0.1vulnerable
Ubuntunbd18.041:3.16.2-1ubuntu0.2fixed
Ubuntunbd20.041:3.19-3vulnerable
Ubuntunbd20.041:3.20-1vulnerable
Ubuntunbd20.041:3.20-1ubuntu0.1fixed
Opensusenbdtumbleweed3.24-1.1fixed
Opensusenbdleap 15.33.24-150000.3.3.1fixed
Ubuntunbd14.041:3.3-3ubuntu1vulnerable
Ubuntunbd14.041:3.4-1ubuntu1vulnerable
Ubuntunbd14.041:3.4-2ubuntu1vulnerable
Ubuntunbd14.041:3.5-1ubuntu1vulnerable
Ubuntunbd14.041:3.6-1ubuntu1vulnerable
Ubuntunbd14.041:3.7-1vulnerable
Ubuntunbd14.041:3.7-1ubuntu0.1vulnerable
Ubuntunbd16.041:3.10-1vulnerable
Ubuntunbd16.041:3.13-1vulnerable
Ubuntunbd18.041:3.15.2-3vulnerable
Ubuntunbd18.041:3.16.2-1vulnerable
Ubuntunbd18.041:3.16.2-1ubuntu0.1vulnerable
Ubuntunbd18.041:3.16.2-1ubuntu0.2fixed
Ubuntunbd20.041:3.19-3vulnerable
Ubuntunbd20.041:3.20-1vulnerable
Ubuntunbd20.041:3.20-1ubuntu0.1fixed
Ubuntunbd22.041:3.21-1build3vulnerable
Ubuntunbd22.041:3.22-1vulnerable
Ubuntunbd22.041:3.23-3vulnerable
Ubuntunbd22.041:3.23-3ubuntu1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannbdsourcesid1:3.24-1not yet assignedNot reported[1006915]
Debiannbdsourceforky1:3.24-1not yet assignedNot reported[1006915]
Debiannbdsourcetrixie1:3.24-1not yet assignedNot reported[1006915]
Debiannbdsourcebookworm1:3.24-1not yet assignedNot reported[1006915]
Ubuntunbddeb18.041:3.16.2-1ubuntu0.2Not reportedUSN-5323-1Not reported
Ubuntunbddeb20.041:3.20-1ubuntu0.1Not reportedUSN-5323-1Not reported
Opensusenbdrpmtumbleweed3.24-1.1Not reportedOPENSUSE-SU-2024:11993-1Not reported
Opensusenbdrpmleap 15.33.24-150000.3.3.1Not reportedSUSE-SU-2022:1276-1Not reported
Ubuntunbddeb18.041:3.16.2-1ubuntu0.2Not reportedUBUNTU-CVE-2022-26495Not reported
Ubuntunbddeb20.041:3.20-1ubuntu0.1Not reportedUBUNTU-CVE-2022-26495Not reported
Ubuntunbddeb22.041:3.23-3ubuntu1Not reportedUBUNTU-CVE-2022-26495Not reported

[Debian bug #1006915]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [nbd-client]Fixed

    Source package: [nbd]

    Details (2)

    • 1:3.24-1.1 · amd64 · bookworm

      Fixed · Fixed: 1:3.24-1

      dsa · nbd · debian · bookworm

    • 1:3.24-1.1 · arm64 · bookworm

      Fixed · Fixed: 1:3.24-1

      dsa · nbd · debian · bookworm

  • [nbd-server]Fixed

    Source package: [nbd]

    Details (2)

    • 1:3.24-1.1 · amd64 · bookworm

      Fixed · Fixed: 1:3.24-1

      dsa · nbd · debian · bookworm

    • 1:3.24-1.1 · arm64 · bookworm

      Fixed · Fixed: 1:3.24-1

      dsa · nbd · debian · bookworm

[openSUSE Tumbleweed]

  • [nbd]Fixed

    Source package: [nbd]

    Details (1)

    • 3.27.1-2.3 · x86_64 · tumbleweed

      Fixed · Fixed: 3.24-1.1

      dsa · nbd · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]