Bug 1757259 (CVE-2019-14851)

Summary:	CVE-2019-14851 nbdkit: assertion failure by issuing commands in the wrong order
Product:	[Other] Security Response	Reporter:	Doran Moppert <dmoppert>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dblechte, dfediuck, eedri, libvirt-maint, mgoldboi, michal.skrivanek, rjones, sbonazzo, sherold, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nbdkit 1.12.8, nbdkit 1.14.2, nbdkit 1.15.2	Doc Type:	If docs needed, set a value
Doc Text:	A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-10-01 06:45:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1751960, 1940184

Description Doran Moppert 2019-10-01 01:20:36 UTC

The fix for the premature open flaw in nbdkit introduced a new vulnerability, in that a client issuing NBD_OPT_INFO before NBD_OPT_GO would trigger back-to-back calls to the open() callback, leading to an assertion failure because the first open() did not have a matching close(). No known nbdkit clients behaved in this way, but a crafted client could use this to cause nbdkit to exit.

Comment 1 Doran Moppert 2019-10-01 01:20:41 UTC

Acknowledgments:

Name: Eric Blake (Red Hat)

Comment 2 Doran Moppert 2019-10-01 01:20:44 UTC

External References:

https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html

Comment 3 Doran Moppert 2019-10-01 01:20:47 UTC

Mitigation:

If nbdkit is configured with TLS client authentication, only trusted clients can carry out this attack.

Only attackers that can connect to the nbdkit service can exploit this vulnerability. If nbdkit is not exposed over TCP (eg, nbdkit -U), or is bound only to a private network interface, or is protected by firewall rules, the attack surface is correspondingly limited.

Comment 5 Doran Moppert 2019-10-01 01:27:11 UTC

Upstream patches:

1.15 (development branch):
 - https://github.com/libguestfs/nbdkit/commit/a6b88b195a959b17524d1c8353fd425d4891dc5f

1.14:
 - https://github.com/libguestfs/nbdkit/commit/bf0d61883a2f02f4388ec10dc92d4c61c093679e

1.12:
 - https://github.com/libguestfs/nbdkit/commit/b2bc6683ea3cd1f6be694e8a681dfa411b7d15f3