A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as successful, rather than checking the *error parameter. This could result in the silent creation of a corrupted destination image.
References
Link | Resource |
---|---|
https://access.redhat.com/security/cve/CVE-2022-0485 | Vendor Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=2046194 | Exploit Issue Tracking Vendor Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=2050324 | Issue Tracking Vendor Advisory |
https://gitlab.com/nbdkit/libnbd/-/commit/8d444b41d09a700c7ee6f9182a649f3f2d325abb | Patch Third Party Advisory |
https://listman.redhat.com/archives/libguestfs/2022-February/msg00104.html | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
01 Dec 2022, 15:15
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.8 |
01 Sep 2022, 20:29
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.4 |
First Time |
Redhat
Redhat libnbd Redhat enterprise Linux |
|
References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2050324 - Issue Tracking, Vendor Advisory | |
References | (MISC) https://access.redhat.com/security/cve/CVE-2022-0485 - Vendor Advisory | |
References | (MISC) https://listman.redhat.com/archives/libguestfs/2022-February/msg00104.html - Patch, Vendor Advisory | |
References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2046194 - Exploit, Issue Tracking, Vendor Advisory | |
References | (MISC) https://gitlab.com/nbdkit/libnbd/-/commit/8d444b41d09a700c7ee6f9182a649f3f2d325abb - Patch, Third Party Advisory | |
CWE | CWE-252 | |
CPE | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:* cpe:2.3:a:redhat:libnbd:*:*:*:*:*:*:*:* |
29 Aug 2022, 15:48
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-08-29 15:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-0485
Mitre link : CVE-2022-0485
CVE.ORG link : CVE-2022-0485
JSON object : View
Products Affected
redhat
- libnbd
- enterprise_linux
CWE
CWE-252
Unchecked Return Value