CVE-2013-7441
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows...
CVE-2013-7441 is a high vulnerability (CVSS 7.8) in Wouter Verhelst Nbd, published May 23, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.72%, the 89th percentile. Fixed in nbd 1:3.4-1.
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.
Exploit likelihood
What each source reports
NVD Score used
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.
- Record
CVE-2013-7441- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.
- Record
CVE-2013-7441- Updated
- 2026-11-02
EUVDEUVD-2013-7205 No score
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.
- Record
EUVD-2013-7205- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jrr7-3c28-9wx3 No score
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows...
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.
- Record
GHSA-jrr7-3c28-9wx3- Updated
- 2026-11-02
OSV No score
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.
- Record
CVE-2013-7441- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-7441 No score
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.
- Record
DEBIAN-CVE-2013-7441- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-7441 No score
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.
- Record
UBUNTU-CVE-2013-7441- Updated
- 2026-11-02
OSVUSN-2676-1 No score
nbd vulnerabilities
It was discovered that NBD incorrectly handled IP address matching. A remote attacker could use this issue with an IP address that has a partial match and bypass access restrictions. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-6410)
Tuomas Räsänen discovered that NBD incorrectly handled wrong export names and closed connections during negotiation. A remote attacker could use this issue to cause NBD to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-7441)
Tuomas Räsänen discovered that NBD incorrectly handled signals. A remote attacker could use this issue to cause NBD to crash, resulting in a denial of service. (CVE-2015-0847)
- Record
USN-2676-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nbdDebian:12 |
before 1:3.4-1 | 1:3.4-1 |
nbdDebian:13 |
before 1:3.4-1 | 1:3.4-1 |
nbdDebian:14 |
before 1:3.4-1 | 1:3.4-1 |
nbdDebian:7 |
before 1:3.2-4~deb7u5, plus listed versions 1:3.2-21:3.2-31:3.2-4~deb7u11:3.2-4~deb7u21:3.2-4~deb7u31:3.2-4~deb7u41:3.2-4~deb7u4~bpo60+11:3.2-4~deb7u5~bpo60+1 |
1:3.2-4~deb7u5 |
nbdDebian:8 |
before 1:3.8-4+deb8u1, plus listed versions 1:3.8-4 |
1:3.8-4+deb8u1 |
nbdUbuntu:14.04:LTS |
before 1:3.7-1ubuntu0.1, plus listed versions 1:3.3-3ubuntu11:3.4-1ubuntu11:3.4-2ubuntu11:3.5-1ubuntu11:3.6-1ubuntu11:3.7-1 |
1:3.7-1ubuntu0.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/74808
debian.org/security/2015/dsa-3271
openwall.com/lists/oss-security/2015/05/19/6
ubuntu.com/usn/USN-2676-1
sourceforge.net/p/nbd/mailman/message/30410146
Show 11 moreShow less
lists.opensuse.org/opensuse-updates/2015-06/msg00003.html
bugs.debian.org/cgi-bin/bugreport.cgi?bug=781547
github.com/yoe/nbd/commit/741495cb08503fd32a9d22648e63b64390c601f4
nvd.nist.gov/vuln/detail/CVE-2013-7441
security-tracker.debian.org/tracker/CVE-2013-7441
ubuntu.com/security/CVE-2013-7441
cve.org/CVERecord?id=CVE-2013-7441