Security update for nbd SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1276-1 Final 1 1 2022-04-20T07:17:17Z current 2022-04-20T07:17:17Z 2022-04-20T07:17:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nbd This update for nbd fixes the following issues: - CVE-2022-26495: Fixed an integer overflow with a resultant heap-based buffer overflow (bsc#1196827). - CVE-2022-26496: Fixed a stack-based buffer overflow when parsing the name field by sending a crafted NBD_OPT_INFO (bsc#1196828). Update to version 3.24 (bsc#1196827, bsc#1196828, CVE-2022-26495, CVE-2022-26496): * https://github.com/advisories/GHSA-q9rw-8758-hccj Update to version 3.23: * Don't overwrite the hostname with the TLS hostname Update to version 3.22: - nbd-server: handle auth for v6-mapped IPv4 addresses - nbd-client.c: parse the next option in all cases - configure.ac: silence a few autoconf 2.71 warnings - spec: Relax NBD_OPT_LIST_META_CONTEXTS - client: Don't confuse Unix socket with TLS hostname - server: Avoid deprecated g_memdup Update to version 3.21: - Fix --disable-manpages build - Fix a bug in whitespace handling regarding authorization files - Support client-side marking of devices as read-only - Support preinitialized NBD connection (i.e., skip the negotiation). - Fix the systemd unit file for nbd-client so it works with netlink (the more common situation nowadays) Update to 3.20.0 (no changelog) Update to version 3.19.0: * Better error messages in case of unexpected disconnects * Better compatibility with non-bash sh implementations (for configure.sh) * Fix for a segfault in NBD_OPT_INFO handling * The ability to specify whether to listen on both TCP and Unix domain sockets, rather than to always do so * Various minor editorial and spelling fixes in the documentation. Update to version 1.18.0: * Client: Add the '-g' option to avoid even trying the NBD_OPT_GO message * Server: fixes to inetd mode * Don't make gnutls and libnl automagic. * Server: bugfixes in handling of some export names during verification. * Server: clean supplementary groups when changing user. * Client: when using the netlink protocol, only set a timeout when there actually is a timeout, rather than defaulting to 0 seconds * Improve documentation on the nbdtab file * Minor improvements to some error messages * Improvements to test suite so it works better on non-GNU userland environments - Update to version 1.17.0: * proto: add xNBD command NBD_CMD_CACHE to the spec * server: do not crash when handling child name * server: Close socket pair when fork fails The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-1276,openSUSE-SLE-15.3-2022-1276,openSUSE-SLE-15.4-2022-1276 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221276-1/ Link for SUSE-SU-2022:1276-1 https://lists.suse.com/pipermail/sle-security-updates/2022-April/010767.html E-Mail link for SUSE-SU-2022:1276-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1196827 SUSE Bug 1196827 https://bugzilla.suse.com/1196828 SUSE Bug 1196828 https://www.suse.com/security/cve/CVE-2022-26495/ SUSE CVE CVE-2022-26495 page https://www.suse.com/security/cve/CVE-2022-26496/ SUSE CVE CVE-2022-26496 page openSUSE Leap 15.3 nbd-3.24-150000.3.3.1 nbd-3.24-150000.3.3.1 as a component of openSUSE Leap 15.3 In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will cause a zero-sized buffer to be allocated for the name, resulting in a write to a dangling pointer. This issue exists for the NBD_OPT_INFO, NBD_OPT_GO, and NBD_OPT_EXPORT_NAME messages. CVE-2022-26495 openSUSE Leap 15.3:nbd-3.24-150000.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221276-1/ https://www.suse.com/security/cve/CVE-2022-26495.html CVE-2022-26495 https://bugzilla.suse.com/1196827 SUSE Bug 1196827 In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name. CVE-2022-26496 openSUSE Leap 15.3:nbd-3.24-150000.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221276-1/ https://www.suse.com/security/cve/CVE-2022-26496.html CVE-2022-26496 https://bugzilla.suse.com/1196828 SUSE Bug 1196828