Bug 1757259 (CVE-2019-14851) - CVE-2019-14851 nbdkit: assertion failure by issuing commands in the wrong order
Summary: CVE-2019-14851 nbdkit: assertion failure by issuing commands in the wrong order
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-14851
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1751960 1940184
TreeView+ depends on / blocked
 
Reported: 2019-10-01 01:20 UTC by Doran Moppert
Modified: 2021-03-17 18:38 UTC (History)
10 users (show)

Fixed In Version: nbdkit 1.12.8, nbdkit 1.14.2, nbdkit 1.15.2
Clone Of:
Environment:
Last Closed: 2019-10-01 06:45:35 UTC
Embargoed:


Attachments (Terms of Use)

Description Doran Moppert 2019-10-01 01:20:36 UTC
The fix for the premature open flaw in nbdkit introduced a new vulnerability, in that a client issuing NBD_OPT_INFO before NBD_OPT_GO would trigger back-to-back calls to the open() callback, leading to an assertion failure because the first open() did not have a matching close(). No known nbdkit clients behaved in this way, but a crafted client could use this to cause nbdkit to exit.

Comment 1 Doran Moppert 2019-10-01 01:20:41 UTC
Acknowledgments:

Name: Eric Blake (Red Hat)

Comment 2 Doran Moppert 2019-10-01 01:20:44 UTC
External References:

https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html

Comment 3 Doran Moppert 2019-10-01 01:20:47 UTC
Mitigation:

If nbdkit is configured with TLS client authentication, only trusted clients can carry out this attack.

Only attackers that can connect to the nbdkit service can exploit this vulnerability. If nbdkit is not exposed over TCP (eg, nbdkit -U), or is bound only to a private network interface, or is protected by firewall rules, the attack surface is correspondingly limited.


Note You need to log in before you can comment on or make changes to this bug.