cve/2022/CVE-2022-26496.md

CVE-2022-26496

Description

In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBD_OPT_INFO or NBD_OPT_GO message with an large value as the length of the name.

POC

Reference

• http://packetstormsecurity.com/files/172148/Shannon-Baseband-fmtp-SDP-Attribute-Memory-Corruption.html
• https://lists.debian.org/nbd/2022/01/msg00037.html

Github

• https://github.com/fkie-cad/nvd-json-data-feeds