{"id":"CVE-2023-5871","aliases":["ALSA-2024:2204","DEBIAN-CVE-2023-5871","EUVD-2023-58145","GHSA-m8ch-v4g3-cq3g","RHSA-2024:2204","SUSE-SU-2023:4463-1","UBUNTU-CVE-2023-5871","openSUSE-SU-2024:13422-1"],"status":"published","title":"Libnbd: malicious nbd server may crash libnbd","description":"A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01108,"percentile":0.66111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-617","CWE-671"],"published":"2023-11-16T16:55:48Z","modified":"2026-11-05T21:15:43Z","fixes":[{"ecosystem":"Debian:13","package":"libnbd","fixed_in":["1.18.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnbd","fixed_in":["1.18.1-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"libnbd","fixed_in":["1.18.1-150300.8.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"libnbd","fixed_in":["1.18.1-150300.8.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libnbd","fixed_in":["1.18.1-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnbd-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nbdfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ocaml-libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ocaml-libnbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libnbd-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libnbd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nbdfuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nbdfuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ocaml-libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnbd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"nbdfuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"ocaml-libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"ocaml-libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"ocaml-libnbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-libnbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.1-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-150300.8.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-150300.8.18.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-1","1.2.1-2","1.2.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3-1","1.8.5-1","1.10.2-1","1.10.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.4-1","1.18.1-1","1.18.2-1","1.18.2-1build1","1.18.2-2","1.18.2-2build1","1.20.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-2.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"libnbd"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:2204","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5871","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247308","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/PFVUCMPFQUDC23JXSCUUPXIGDZ7XCFMD/","tags":["x_transferred","Mailing List","Patch","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5871","tags":["advisory"]},{"url":"https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/PFVUCMPFQUDC23JXSCUUPXIGDZ7XCFMD"},{"url":"https://github.com/advisories/GHSA-m8ch-v4g3-cq3g"},{"url":"https://access.redhat.com/security/cve/CVE-2023-5215","tags":["report"]},{"url":"https://bugzilla.redhat.com/2241041","tags":["report"]},{"url":"https://bugzilla.redhat.com/2247308","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2204.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5871.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-5871","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241041","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-14476","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-16292","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7099","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2204.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5215","tags":["advisory"]},{"url":"https://listman.redhat.com/archives/libguestfs/2023-September/032635.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5871","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234463-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216769","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5871","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-5871","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-5871","title":"Libnbd: malicious nbd server may crash libnbd","description":"A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.","status":"published","published":"2023-11-27T11:58:44.737Z","modified":"2026-11-05T11:36:23.35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-617"],"updated_at":"2026-11-05T13:18:22.408512Z"}],"euvd":[{"id":"EUVD-2023-58145","description":"A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.","status":"published","published":"2023-11-27T11:58:44Z","modified":"2026-11-05T11:36:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T13:14:14.11293Z"}],"ghsa":[{"id":"GHSA-m8ch-v4g3-cq3g","title":"A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for...","description":"A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.","status":"published","published":"2023-11-27T12:30:55Z","modified":"2024-05-10T05:03:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-617","CWE-671"],"updated_at":"2026-11-02T14:57:20.80512Z"}],"nvd":[{"id":"CVE-2023-5871","description":"A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.","status":"published","published":"2023-11-27T12:15:07.94Z","modified":"2026-11-05T12:17:34.81Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-617"],"updated_at":"2026-11-05T16:36:40.983114Z"}],"osv":[{"id":"CVE-2023-5871","title":"Libnbd: malicious nbd server may crash libnbd","description":"A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.","status":"published","published":"2023-11-27T11:58:44.737Z","modified":"2026-11-07T02:30:27.149213256Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-07T03:07:52.010191Z"},{"id":"DEBIAN-CVE-2023-5871","description":"A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.","status":"published","published":"2023-11-27T12:15:07.94Z","modified":"2026-10-26T18:03:10.256346821Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:41.533064Z"},{"id":"RHSA-2024:2204","title":"Red Hat Security Advisory: libnbd security update","status":"published","published":"2024-09-16T15:58:41Z","modified":"2026-06-29T10:57:16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-5871","description":"A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.","status":"published","published":"2023-11-27T12:15:00Z","modified":"2026-04-22T14:34:27.646025Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"ALSA-2024:2204","title":"Moderate: libnbd security update","description":"Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients.\n\nSecurity Fix(es):\n\n* libnbd: Malicious NBD server may crash libnbd (CVE-2023-5871)\n* libnbd: Crash or misbehaviour when NBD server returns an unexpected block size (CVE-2023-5215)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:42.496739825Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"openSUSE-SU-2024:13422-1","title":"libnbd-1.18.1-2.1 on GA media","description":"These are all security issues fixed in the libnbd-1.18.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:22:30.281364Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4463-1","title":"Security update for libnbd","description":"This update for libnbd fixes the following issues:\n\n- CVE-2023-5871: Fixed an assertion problem in ext-mode BLOCK_STATUS (bsc#1216769).\n","status":"published","published":"2023-11-16T16:55:48Z","modified":"2026-02-04T04:18:50.286374Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}