Bug 2423789 (CVE-2025-14946)

Summary: CVE-2025-14946 libnbd: libnbd: Arbitrary code execution via SSH argument injection through a malicious URI
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: fdeutsch, oramraz, security-response-team, smullick, stirabos, thason
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2025-12-20   

Description OSIDB Bzimport 2025-12-19 03:37:43 UTC 
The recent addition of nbd+ssh:// URIs to have libnbd initiate a connection to an NBD server via an ssh process did not sanitize the hostname of the ssh server. If a malicious actor can convince libnbd to open an arbitrary URI, use of non-standard hostnames beginning with '-o' would be treated as arguments to the ssh process rather than a hostname, which in turn could trigger execution of arbitrary processes under the privilege of the user running libnbd.