SB2024043062 - Red Hat Enterprise Linux 9 update for libnbd
Published: April 30, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Reachable Assertion (CVE-ID: CVE-2023-5871)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion in nbd_block_status() function. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.
2) Unchecked Return Value (CVE-ID: CVE-2023-5215)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when handling server responses in NBD client. A remote server can return a block size larger than 2^63 and crash the client.
Remediation
Install update from vendor's website.