CVE-2023-5871
Libnbd: malicious nbd server may crash libnbd
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Libnbd: malicious nbd server may crash libnbd
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.
- Record
CVE-2023-5871- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-617
- Updated
- 2026-11-05
EUVDEUVD-2023-58145
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.
- Record
EUVD-2023-58145- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-m8ch-v4g3-cq3g
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for...
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.
- Record
GHSA-m8ch-v4g3-cq3g- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400, CWE-617, CWE-671
- Updated
- 2026-11-02
NVD
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.
- Record
CVE-2023-5871- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-617
- Updated
- 2026-11-05
OSV
Libnbd: malicious nbd server may crash libnbd
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.
- Record
CVE-2023-5871- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-617
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2023-5871
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.
- Record
DEBIAN-CVE-2023-5871- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2024:2204
Red Hat Security Advisory: libnbd security update
- Record
RHSA-2024:2204- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-5871
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.
- Record
UBUNTU-CVE-2023-5871- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVALSA-2024:2204 No score
Moderate: libnbd security update
Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients.
Security Fix(es):
- libnbd: Malicious NBD server may crash libnbd (CVE-2023-5871)
- libnbd: Crash or misbehaviour when NBD server returns an unexpected block size (CVE-2023-5215)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2024:2204- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13422-1 No score
libnbd-1.18.1-2.1 on GA media
These are all security issues fixed in the libnbd-1.18.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13422-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4463-1 No score
Security update for libnbd
This update for libnbd fixes the following issues:
- CVE-2023-5871: Fixed an assertion problem in ext-mode BLOCK_STATUS (bsc#1216769).
- Record
SUSE-SU-2023:4463-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libnbdAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.18.1-3.el9 | 1.18.1-3.el9 |
libnbd-bash-completionAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.18.1-3.el9 | 1.18.1-3.el9 |
libnbd-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.18.1-3.el9 | 1.18.1-3.el9 |
nbdfuseAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.18.1-3.el9 | 1.18.1-3.el9 |
ocaml-libnbdAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.18.1-3.el9 | 1.18.1-3.el9 |
ocaml-libnbd-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.18.1-3.el9 | 1.18.1-3.el9 |
python3-libnbdAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.18.1-3.el9 | 1.18.1-3.el9 |
libnbdDebian:13 |
before 1.18.1-1 | 1.18.1-1 |
libnbdDebian:14 |
before 1.18.1-1 | 1.18.1-1 |
libnbdRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libnbd-bash-completionRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
libnbd-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
libnbd-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
nbdfuseRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
nbdfuse-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
ocaml-libnbd-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
python3-libnbdRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
python3-libnbd-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
libnbd-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
libnbd-debugsourceRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
libnbd-develRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
nbdfuse-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
ocaml-libnbdRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
ocaml-libnbd-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
ocaml-libnbd-develRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
python3-libnbd-debuginfoRed Hat:enterprise_linux:9::crb From an advisory covering 2 CVEs |
before 0:1.18.1-3.el9 | 0:1.18.1-3.el9 |
libnbdopenSUSE:Leap 15.4 |
before 1.18.1-150300.8.18.1 | 1.18.1-150300.8.18.1 |
libnbdopenSUSE:Leap 15.5 |
before 1.18.1-150300.8.18.1 | 1.18.1-150300.8.18.1 |
libnbdUbuntu:20.04:LTS |
All versions, plus listed versions 1.0.3-11.2.1-21.2.2-1ubuntu2 |
None known |
libnbdUbuntu:22.04:LTS |
All versions, plus listed versions 1.6.3-11.8.5-11.10.2-11.10.5-1 |
None known |
libnbdUbuntu:24.04:LTS |
All versions, plus listed versions 1.16.4-11.18.1-11.18.2-11.18.2-1build11.18.2-21.18.2-2build11.20.0-1 |
None known |
libnbdopenSUSE:Tumbleweed |
before 1.18.1-2.1 | 1.18.1-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, NVD, OSV | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5871 is a medium vulnerability (CVSS 5.3) in Redhat Libnbd, published November 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in libnbd 1.18.1-1.
References
access.redhat.com/errata/RHSA-2024:2204
bugzilla.redhat.com/show_bug.cgi?id=2247308
lists.libguestfs.org/archives/list/[email protected]/thread/PFVUCMPFQUDC23JXSCUUPXIGDZ7XCFMD
nvd.nist.gov/vuln/detail/CVE-2023-5871
github.com/advisories/GHSA-m8ch-v4g3-cq3g
Show 22 moreShow less
errata.almalinux.org/9/ALSA-2024-2204.html
security-tracker.debian.org/tracker/CVE-2023-5871
issues.redhat.com/browse/RHEL-14476
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2204.json
cve.org/CVERecord?id=CVE-2023-5215
listman.redhat.com/archives/libguestfs/2023-September/032635.html
suse.com/support/update/announcement/2023/suse-su-20234463-1
bugzilla.suse.com/1216769
ubuntu.com/security/CVE-2023-5871