{"id":"CVE-2023-5215","aliases":["ALPINE-CVE-2023-5215","ALSA-2024:2204","AZL-31095","AZL-34933","CLSA-2026-1778007485","DEBIAN-CVE-2023-5215","EUVD-2023-57545","GHSA-fj2q-5f6j-5xf4","MGASA-2024-0174","RHSA-2024:2204","SUSE-SU-2023:4222-1","UBUNTU-CVE-2023-5215","openSUSE-SU-2024:13278-1"],"status":"published","title":"Libnbd: crash or misbehaviour when nbd server returns an unexpected block size","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00806,"percentile":0.57053,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-241","CWE-252"],"published":"2023-09-28T13:55:32Z","modified":"2026-11-03T06:32:43Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"libnbd","fixed_in":["1.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libnbd","fixed_in":["1.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libnbd","fixed_in":["1.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libnbd","fixed_in":["1.18.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libnbd","fixed_in":["1.18.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libnbd","fixed_in":["1.12.1-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libnbd","fixed_in":["1.12.1-3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libnbd","fixed_in":["1.14.2-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libnbd-bash-completion","fixed_in":["1.14.2-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libnbd-devel","fixed_in":["1.14.2-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nbdfuse","fixed_in":["1.14.2-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"ocaml-libnbd","fixed_in":["1.14.2-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"ocaml-libnbd-devel","fixed_in":["1.14.2-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-libnbd","fixed_in":["1.14.2-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libnbd","fixed_in":["1.16.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnbd","fixed_in":["1.16.5-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libnbd","fixed_in":["1.15.8-3.1.mga9"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"libnbd","fixed_in":["1.18.1-150300.8.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"libnbd","fixed_in":["1.18.1-150300.8.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libnbd","fixed_in":["1.18.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnbd-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nbdfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ocaml-libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ocaml-libnbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libnbd-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libnbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nbdfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ocaml-libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ocaml-libnbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.2-1","1.16.1-1","1.16.2-1","1.16.3-1","1.16.4-1","1.16.5-1","1.18.0-1","1.18.1-1","1.18.2-1","1.18.2-2","1.20.0-1","1.20.1-1","1.20.2-1","1.20.2-2","1.20.3-1","1.22.0-1","1.22.2-1","1.22.3-1","1.22.5-1","1.24.0-1","1.24.0-2","1.24.0-2.1","1.24.1-1","1.24.2-1","1.24.2-2","1.24.3-1","1.24.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.5-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.8-3.1.mga9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libnbd-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libnbd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nbdfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nbdfuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ocaml-libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnbd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"nbdfuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"ocaml-libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"ocaml-libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"ocaml-libnbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-150300.8.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-150300.8.15.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-1","1.2.1-2","1.2.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3-1","1.8.5-1","1.10.2-1","1.10.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.4-1","1.18.1-1","1.18.2-1","1.18.2-1build1","1.18.2-2","1.18.2-2build1","1.20.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.0-1","1.22.2-1build1","1.22.2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.2-1ubuntu1","1.24.2-2ubuntu1","1.24.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-1build2","1.24.0-2ubuntu1","1.24.1-1ubuntu6","1.24.2-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8 advanced virtualization"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"libnbd"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:2204","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5215","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241041","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://listman.redhat.com/archives/libguestfs/2023-September/032635.html","tags":["x_transferred","Exploit","Patch","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5215","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fj2q-5f6j-5xf4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-5215","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5871","tags":["report"]},{"url":"https://bugzilla.redhat.com/2241041","tags":["report"]},{"url":"https://bugzilla.redhat.com/2247308","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2204.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778007485.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5215.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-5215","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0174.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33164","tags":["report"]},{"url":"https://lwn.net/Articles/971701/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247308","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-14476","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-16292","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7099","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2204.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5215","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5871","tags":["advisory"]},{"url":"https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/PFVUCMPFQUDC23JXSCUUPXIGDZ7XCFMD/","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234222-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215799","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5215","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-5215","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-5215","title":"Libnbd: crash or misbehaviour when nbd server returns an unexpected block size","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","status":"published","published":"2023-09-28T13:55:32.462Z","modified":"2025-11-08T08:55:24.112Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-241"],"updated_at":"2026-11-02T14:35:17.149492Z"}],"euvd":[{"id":"EUVD-2023-57545","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","status":"published","published":"2023-09-28T13:55:32Z","modified":"2025-11-08T08:55:24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:19.321345Z"}],"ghsa":[{"id":"GHSA-fj2q-5f6j-5xf4","title":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec...","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","status":"published","published":"2023-09-28T15:30:17Z","modified":"2024-04-30T15:30:34Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-241","CWE-252"],"updated_at":"2026-11-02T14:57:15.605145Z"}],"nvd":[{"id":"CVE-2023-5215","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","status":"published","published":"2023-09-28T14:15:26.117Z","modified":"2026-06-17T06:48:06.327Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-241","CWE-252"],"updated_at":"2026-11-02T14:08:31.699785Z"}],"osv":[{"id":"ALPINE-CVE-2023-5215","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","status":"published","published":"2023-09-28T14:15:26.117Z","modified":"2026-11-03T06:32:43.91677598Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"AZL-31095","title":"CVE-2023-5215 affecting package libnbd for versions less than 1.12.1-3","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","status":"published","published":"2023-09-28T14:15:26Z","modified":"2026-04-21T04:26:04.800686Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-34933","title":"CVE-2023-5215 affecting package libnbd for versions less than 1.12.1-3","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","status":"published","published":"2023-09-28T14:15:26Z","modified":"2026-04-21T04:53:43.969833Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"CVE-2023-5215","title":"Libnbd: crash or misbehaviour when nbd server returns an unexpected block size","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","status":"published","published":"2023-09-28T13:55:32.462Z","modified":"2026-10-28T02:31:04.873066743Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-241"],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DEBIAN-CVE-2023-5215","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","status":"published","published":"2023-09-28T14:15:26.117Z","modified":"2026-10-26T18:03:07.549418368Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"RHSA-2024:2204","title":"Red Hat Security Advisory: libnbd security update","status":"published","published":"2024-09-16T15:58:41Z","modified":"2026-06-29T10:57:16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-5215","description":"A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.","status":"published","published":"2023-09-28T14:15:00Z","modified":"2026-10-17T12:57:21.955724983Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"ALSA-2024:2204","title":"Moderate: libnbd security update","description":"Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients.\n\nSecurity Fix(es):\n\n* libnbd: Malicious NBD server may crash libnbd (CVE-2023-5871)\n* libnbd: Crash or misbehaviour when NBD server returns an unexpected block size (CVE-2023-5215)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:42.496739825Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2026-1778007485","title":"libnbd: Fix of CVE-2023-5215","description":"- CVE-2023-5215: fix nbd_get_size returning negative value for sizes larger than INT64_MAX","status":"published","published":"2026-05-05T18:58:11Z","modified":"2026-06-01T00:31:49.776530511Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"MGASA-2024-0174","title":"Updated libnbd packages fix security vulnerability","description":"A flaw was found in libnbd. A server can reply with a block size larger\nthan 2^63 (the NBD spec states the size is a 64-bit unsigned value).\nThis issue could lead to an application crash or other unintended\nbehavior for NBD clients that doesn't treat the return value of the\nnbd_get_size() function correctly. (CVE-2023-5215)\n","status":"published","published":"2024-05-10T16:09:48Z","modified":"2026-04-16T04:43:37.538246658Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13278-1","title":"libnbd-1.18.0-1.1 on GA media","description":"These are all security issues fixed in the libnbd-1.18.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:51.98673Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:4222-1","title":"Security update for libnbd","description":"This update for libnbd fixes the following issues:\n\n- Updated to version 1.18.1\n- Updated to version 1.18.0:\n\n  - CVE-2023-5215: Fixed an issue where an NBD server returning an\n    unexpected block size might crash an application (bsc#1215799).\n","status":"published","published":"2023-10-27T06:54:40Z","modified":"2026-02-04T02:32:44.859961Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}