Nixpkgs Security Tracker

Login with GitHub

Suggestions search

With package: nbdkit

Found 2 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2025-47712
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 6 months ago
Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service

A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.

References

Affected products

nbdkit
  • <1.40.6
  • <1.42.3
  • <1.38.6
virt:av/nbdkit
virt:8.2/nbdkit
virt:rhel/nbdkit

Matching in nixpkgs

pkgs.nbdkit

NBD server with stable plugin ABI and permissive license

  • nixos-unstable -

Package maintainers

Untriaged
Permalink CVE-2025-47711
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 6 months ago
Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service

There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.

References

Affected products

nbdkit
  • <1.42.3
  • <1.40.6
  • <1.38.6
virt:av/nbdkit
virt:8.2/nbdkit
virt:rhel/nbdkit

Matching in nixpkgs

pkgs.nbdkit

NBD server with stable plugin ABI and permissive license

  • nixos-unstable -

Package maintainers