Eric Blake

**Name of the Vulnerable Software and Affected Versions** nbdkit (affected versions not specified) **Description** A flaw was found in nbdkit due to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD OPT STRUCTURED REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libnbd version 1.7.3 Description: A flaw was found in libnbd that may lead to denial of service due to an assertion failure in the `nbd unlocked opt go` function in `ilb/opt.c`. Recommendations: For libnbd version 1.7.3, consider disabling the `nbd unlocked opt go` function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU versions prior to 5.0.1 **Description** An assertion failure issue was found in the Network Block Device (NBD) Server. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server, resulting in a denial of service. **Recommendations** For QEMU versions prior to 5.0.1, update to QEMU 5.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the NBD server to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: qemu versions prior to 2.11 Description: A stack-based buffer overflow issue was discovered in the NBD server implementation, allowing a client to request an export name larger than the intended limit, resulting in an out-of-bounds stack write. The issue can only be triggered if the attacker can successfully negotiate TLS when it is required by the NBD server. Recommendations: For versions prior to 2.11, update to version 2.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the NBD server or disabling TLS negotiation to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QEMU versions prior to 2.11 **Description** The issue is related to a denial of service problem in the Network Block Device (NBD) server. It can be triggered by a client sending large option requests, causing the server to waste CPU time. This could allow a remote attacker to keep the NBD server from serving other requests, resulting in a denial of service. **Recommendations** For versions prior to 2.11, update to version 2.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the NBD server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** The issue is caused by an integer overflow in the ROUND UP (n, d) macro of the QEMU hardware emulator. This can be exploited to cause a denial of service, resulting in a crash of the QEMU process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU (aka Quick Emulator) versions (affected versions not specified) **Description** The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and server crash. This is due to the failure to ensure all initialization occurs before talking to a client in the `nbd negotiate` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** libvirt versions 1.0.1 through 1.2.1 **Description** The issue allows local users to delete arbitrary host devices via the "virDomainDeviceDettach" API and a symlink attack on "/dev" in the container. It also enables users to create arbitrary nodes via the "virDomainDeviceAttach" API and a symlink attack on "/dev" in the container. Furthermore, it can cause a denial of service, such as shutting down or rebooting the host OS, via the "virDomainShutdown" or "virDomainReboot" API and a symlink attack on "/dev/initctl" in the container. This is related to paths under "/proc/$PID/root" and the `virInitctlSetRunLevel` function. **Recommendations** For libvirt versions 1.0.1 through 1.2.1, consider disabling the `virDomainDeviceDettach` and `virDomainDeviceAttach` APIs as a temporary workaround to prevent arbitrary device deletion and node creation. Additionally, restrict access to the `virDomainShutdown` and `virDomainReboot` APIs to minimize the risk of denial of service attacks. Avoid using the `virInitctlSetRunLevel` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libvirt versions 1.1.1 through 1.2.0 **Description** The issue allows context-dependent attackers to bypass restrictions in ACLs, specifically the domain:getattr and connect:search domains restrictions, and obtain sensitive domain object information. This is achieved via a request to the (1) `virConnectDomainEventRegister` and (2) `virConnectDomainEventRegisterAny` functions in the event registration API. **Recommendations** For libvirt versions 1.1.1 through 1.2.0, consider restricting access to the `virConnectDomainEventRegister` and `virConnectDomainEventRegisterAny` functions in the event registration API until a patch is available.