RedHat has issued an advisory on April 30: https://lwn.net/Articles/971701/
Source RPM: (none) => libnbd-1.17.5-4.mga10.src.rpmCVE: (none) => CVE-2023-5871, CVE-2023-5215Whiteboard: (none) => MGA9TOO
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5871 Neither here nor the RedHat URL indicates the fix, but the latter says "An update for libnbd is now available". There is a better generic CVE site which is more comprehensive, but I have forgotten it. Assigning globally hoping someone can discover more.
Assignee: bugsquad => pkg-bugs
CVE-2023-5871 only concerns Cauldron.
Suggested advisory: ======================== The updated packages fix a security vulnerability: A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly. (CVE-2023-5215) References: https://lwn.net/Articles/971701/ ======================== Updated packages in core/updates_testing: ======================== lib(64)nbd0-1.15.8-3.1.mga9 lib(64)nbd-devel-1.15.8-3.1.mga9 libnbd-1.15.8-3.1.mga9 libnbd-bash-completion-1.15.8-3.1.mga9 nbdfuse-1.15.8-3.1.mga9 nbdublk-1.15.8-3.1.mga9 ocaml-libnbd-1.15.8-3.1.mga9 ocaml-libnbd-devel-1.15.8-3.1.mga9 python3-libnbd-1.15.8-3.1.mga9 from SRPM: libnbd-1.15.8-3.1.mga9.src.rpm
Whiteboard: MGA9TOO => (none)Version: Cauldron => 9Assignee: pkg-bugs => qa-bugsStatus: NEW => ASSIGNEDCVE: CVE-2023-5871, CVE-2023-5215 => CVE-2023-5215Source RPM: libnbd-1.17.5-4.mga10.src.rpm => libnbd-1.15.8-3.mga9.src.rpm
CC: (none) => mageia
Keywords: (none) => advisory
CVE-2023-5215 There appears to be a test that can be run to demonstrate the problem but it involves qemu, about which I know nothing: https://listman.redhat.com/archives/libguestfs/2023-September/032635.html $ qemu-nbd -f raw -r file -t & <That does not work in the absence of meaningful files> $ nbdsh --base -u nbd://localhost -c - <<\EOF This should return a large negative number before the update. After the update expect to see a proper error report.
CC: (none) => tarazed25
RH mageia 9 x86_64 Not previous round, I test Install/Uninstall LC_ALL=C urpmi /home/katnatek/qa-testing/x86_64/*.rpm To satisfy dependencies, the following packages are going to be installed: Package Version Release Arch (medium "Core Release (distrib1)") lib64event-devel 2.1.12 4.mga9 x86_64 lib64ffi-devel 3.4.4 1.mga9 x86_64 lib64gmp-devel 6.2.1 3.mga9 x86_64 lib64mnl-devel 1.0.5 1.mga9 x86_64 lib64nettle-devel 3.9 1.mga9 x86_64 lib64p11-kit-devel 0.24.1 2.mga9 x86_64 lib64tasn1-devel 4.19.0 1.mga9 x86_64 lib64ublksrv0 1.0 3.mga9 x86_64 libtasn1-tools 4.19.0 1.mga9 x86_64 (medium "Core Updates (distrib3)") gnutls 3.8.4 1.mga9 x86_64 lib64gnutls-dane0 3.8.4 1.mga9 x86_64 lib64gnutls-devel 3.8.4 1.mga9 x86_64 lib64gnutlsxx30 3.8.4 1.mga9 x86_64 lib64python3-devel 3.10.11 1.2.mga9 x86_64 lib64python3.10-testsuite 3.10.11 1.2.mga9 x86_64 (recommended) lib64unbound-devel 1.19.1 1.mga9 x86_64 lib64xml2-devel 2.10.4 1.2.mga9 x86_64 python3-docs 3.10.11 1.2.mga9 noarch (recommended) tkinter3 3.10.11 1.2.mga9 x86_64 (recommended) (command line) lib64nbd-devel 1.15.8 3.1.mga9 x86_64 lib64nbd0 1.15.8 3.1.mga9 x86_64 libnbd 1.15.8 3.1.mga9 x86_64 libnbd-bash-completion 1.15.8 3.1.mga9 noarch nbdfuse 1.15.8 3.1.mga9 x86_64 nbdublk 1.15.8 3.1.mga9 x86_64 ocaml-libnbd 1.15.8 3.1.mga9 x86_64 ocaml-libnbd-devel 1.15.8 3.1.mga9 x86_64 python3-libnbd 1.15.8 3.1.mga9 x86_64 166MB of additional disk space will be used. 24MB of packages will be retrieved. Proceed with the installation of the 28 packages? (Y/n) y https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/libtasn1-tools-4.19.0-1.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/lib64tasn1-devel-4.19.0-1.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/lib64gmp-devel-6.2.1-3.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/lib64ffi-devel-3.4.4-1.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/lib64p11-kit-devel-0.24.1-2.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/lib64ublksrv0-1.0-3.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/lib64mnl-devel-1.0.5-1.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/lib64event-devel-2.1.12-4.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/lib64nettle-devel-3.9-1.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/lib64python3-devel-3.10.11-1.2.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/python3-docs-3.10.11-1.2.mga9.noarch.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/lib64xml2-devel-2.10.4-1.2.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/lib64gnutls-dane0-3.8.4-1.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/lib64python3.10-testsuite-3.10.11-1.2.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/gnutls-3.8.4-1.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/lib64gnutls-devel-3.8.4-1.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/tkinter3-3.10.11-1.2.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/lib64unbound-devel-1.19.1-1.mga9.x86_64.rpm https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/lib64gnutlsxx30-3.8.4-1.mga9.x86_64.rpm installing /var/cache/urpmi/rpms/lib64python3-devel-3.10.11-1.2.mga9.x86_64.rpm /var/cache/urpmi/rpms/gnutls-3.8.4-1.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64ffi-devel-3.4.4-1.mga9.x86_64.rpm /home/katnatek/qa-testing/x86_64/lib64nbd-devel-1.15.8-3.1.mga9.x86_64.rpm /home/katnatek/qa-testing/x86_64/libnbd-bash-completion-1.15.8-3.1.mga9.noarch.rpm /var/cache/urpmi/rpms/lib64gnutlsxx30-3.8.4-1.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64unbound-devel-1.19.1-1.mga9.x86_64.rpm /home/katnatek/qa-testing/x86_64/ocaml-libnbd-devel-1.15.8-3.1.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64xml2-devel-2.10.4-1.2.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64p11-kit-devel-0.24.1-2.mga9.x86_64.rpm /home/katnatek/qa-testing/x86_64/libnbd-1.15.8-3.1.mga9.x86_64.rpm /home/katnatek/qa-testing/x86_64/python3-libnbd-1.15.8-3.1.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64gnutls-devel-3.8.4-1.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64mnl-devel-1.0.5-1.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64event-devel-2.1.12-4.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64tasn1-devel-4.19.0-1.mga9.x86_64.rpm /var/cache/urpmi/rpms/python3-docs-3.10.11-1.2.mga9.noarch.rpm /home/katnatek/qa-testing/x86_64/nbdublk-1.15.8-3.1.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64gnutls-dane0-3.8.4-1.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64python3.10-testsuite-3.10.11-1.2.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64ublksrv0-1.0-3.mga9.x86_64.rpm /var/cache/urpmi/rpms/tkinter3-3.10.11-1.2.mga9.x86_64.rpm /home/katnatek/qa-testing/x86_64/lib64nbd0-1.15.8-3.1.mga9.x86_64.rpm /var/cache/urpmi/rpms/libtasn1-tools-4.19.0-1.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64gmp-devel-6.2.1-3.mga9.x86_64.rpm /home/katnatek/qa-testing/x86_64/ocaml-libnbd-1.15.8-3.1.mga9.x86_64.rpm /home/katnatek/qa-testing/x86_64/nbdfuse-1.15.8-3.1.mga9.x86_64.rpm /var/cache/urpmi/rpms/lib64nettle-devel-3.9-1.mga9.x86_64.rpm Preparing... ################################################################################################## 1/28: lib64nbd0 ################################################################################################## 2/28: libnbd ################################################################################################## 3/28: lib64gmp-devel ################################################################################################## 4/28: lib64gnutls-dane0 ################################################################################################## 5/28: gnutls ################################################################################################## 6/28: lib64nettle-devel ################################################################################################## 7/28: ocaml-libnbd ################################################################################################## 8/28: libtasn1-tools ################################################################################################## 9/28: lib64tasn1-devel ################################################################################################## 10/28: tkinter3 ################################################################################################## 11/28: lib64python3.10-testsuite ################################################################################################## 12/28: lib64ublksrv0 ################################################################################################## 13/28: python3-docs ################################################################################################## 14/28: lib64python3-devel ################################################################################################## 15/28: lib64event-devel ################################################################################################## 16/28: lib64mnl-devel ################################################################################################## 17/28: lib64unbound-devel ################################################################################################## 18/28: lib64xml2-devel ################################################################################################## 19/28: lib64gnutlsxx30 ################################################################################################## 20/28: lib64ffi-devel ################################################################################################## 21/28: lib64p11-kit-devel ################################################################################################## 22/28: lib64gnutls-devel ################################################################################################## 23/28: lib64nbd-devel ################################################################################################## 24/28: nbdublk ################################################################################################## 25/28: ocaml-libnbd-devel ################################################################################################## 26/28: libnbd-bash-completion ################################################################################################## 27/28: python3-libnbd ################################################################################################## 28/28: nbdfuse ################################################################################################## LC_ALL=C urpme $(rpm -qa|grep nbd) removing lib64nbd-devel-1.15.8-3.1.mga9.x86_64 lib64nbd0-1.15.8-3.1.mga9.x86_64 libnbd-1.15.8-3.1.mga9.x86_64 libnbd-bash-completion-1.15.8-3.1.mga9.noarch nbdfuse-1.15.8-3.1.mga9.x86_64 nbdublk-1.15.8-3.1.mga9.x86_64 ocaml-libnbd-1.15.8-3.1.mga9.x86_64 ocaml-libnbd-devel-1.15.8-3.1.mga9.x86_64 python3-libnbd-1.15.8-3.1.mga9.x86_64 removing package ocaml-libnbd-devel-1.15.8-3.1.mga9.x86_64 1/9: removing ocaml-libnbd-devel-1.15.8-3.1.mga9.x86_64 ################################################################################################## removing package lib64nbd-devel-1.15.8-3.1.mga9.x86_64 2/9: removing lib64nbd-devel-1.15.8-3.1.mga9.x86_64 ################################################################################################## removing package libnbd-bash-completion-1.15.8-3.1.mga9.noarch 3/9: removing libnbd-bash-completion-1.15.8-3.1.mga9.noarch ################################################################################################## removing package ocaml-libnbd-1.15.8-3.1.mga9.x86_64 4/9: removing ocaml-libnbd-1.15.8-3.1.mga9.x86_64 ################################################################################################## removing package python3-libnbd-1.15.8-3.1.mga9.x86_64 5/9: removing python3-libnbd-1.15.8-3.1.mga9.x86_64 ################################################################################################## removing package nbdublk-1.15.8-3.1.mga9.x86_64 6/9: removing nbdublk-1.15.8-3.1.mga9.x86_64 ################################################################################################## removing package libnbd-1.15.8-3.1.mga9.x86_64 7/9: removing libnbd-1.15.8-3.1.mga9.x86_64 ################################################################################################## removing package nbdfuse-1.15.8-3.1.mga9.x86_64 8/9: removing nbdfuse-1.15.8-3.1.mga9.x86_64 ################################################################################################## removing package lib64nbd0-1.15.8-3.1.mga9.x86_64 9/9: removing lib64nbd0-1.15.8-3.1.mga9.x86_64 ################################################################################################## writing /var/lib/rpm/installed-through-deps.list The following packages: gnutls-3.8.4-1.mga9.x86_64 lib64event-devel-2.1.12-4.mga9.x86_64 lib64ffi-devel-3.4.4-1.mga9.x86_64 lib64gmp-devel-6.2.1-3.mga9.x86_64 lib64gnutls-dane0-3.8.4-1.mga9.x86_64 lib64gnutls-devel-3.8.4-1.mga9.x86_64 lib64gnutlsxx30-3.8.4-1.mga9.x86_64 lib64mnl-devel-1.0.5-1.mga9.x86_64 lib64nettle-devel-3.9-1.mga9.x86_64 lib64p11-kit-devel-0.24.1-2.mga9.x86_64 lib64python3-devel-3.10.11-1.2.mga9.x86_64 lib64python3.10-testsuite-3.10.11-1.2.mga9.x86_64 lib64tasn1-devel-4.19.0-1.mga9.x86_64 lib64ublksrv0-1.0-3.mga9.x86_64 lib64unbound-devel-1.19.1-1.mga9.x86_64 lib64xml2-devel-2.10.4-1.2.mga9.x86_64 libtasn1-tools-4.19.0-1.mga9.x86_64 python3-docs-3.10.11-1.2.mga9.noarch tkinter3-3.10.11-1.2.mga9.x86_64 are now orphaned, if you wish to remove them, you can use "urpme --auto-orphans" LC_ALL=C urpme --auto-orphans --auto removing gnutls-3.8.4-1.mga9.x86_64 lib64event-devel-2.1.12-4.mga9.x86_64 lib64ffi-devel-3.4.4-1.mga9.x86_64 lib64gmp-devel-6.2.1-3.mga9.x86_64 lib64gnutls-dane0-3.8.4-1.mga9.x86_64 lib64gnutls-devel-3.8.4-1.mga9.x86_64 lib64gnutlsxx30-3.8.4-1.mga9.x86_64 lib64mnl-devel-1.0.5-1.mga9.x86_64 lib64nettle-devel-3.9-1.mga9.x86_64 lib64p11-kit-devel-0.24.1-2.mga9.x86_64 lib64python3-devel-3.10.11-1.2.mga9.x86_64 lib64python3.10-testsuite-3.10.11-1.2.mga9.x86_64 lib64tasn1-devel-4.19.0-1.mga9.x86_64 lib64ublksrv0-1.0-3.mga9.x86_64 lib64unbound-devel-1.19.1-1.mga9.x86_64 lib64xml2-devel-2.10.4-1.2.mga9.x86_64 libtasn1-tools-4.19.0-1.mga9.x86_64 python3-docs-3.10.11-1.2.mga9.noarch tkinter3-3.10.11-1.2.mga9.x86_64 removing package lib64gnutls-devel-3.8.4-1.mga9.x86_64 1/19: removing lib64gnutls-devel-3.8.4-1.mga9.x86_64 ################################################################################################## removing package lib64unbound-devel-1.19.1-1.mga9.x86_64 2/19: removing lib64unbound-devel-1.19.1-1.mga9.x86_64 ################################################################################################## removing package lib64nettle-devel-1:3.9-1.mga9.x86_64 3/19: removing lib64nettle-devel-1:3.9-1.mga9.x86_64 ################################################################################################## removing package lib64tasn1-devel-4.19.0-1.mga9.x86_64 4/19: removing lib64tasn1-devel-4.19.0-1.mga9.x86_64 ################################################################################################## removing package lib64gmp-devel-6.2.1-3.mga9.x86_64 5/19: removing lib64gmp-devel-6.2.1-3.mga9.x86_64 ################################################################################################## removing package lib64event-devel-2.1.12-4.mga9.x86_64 6/19: removing lib64event-devel-2.1.12-4.mga9.x86_64 ################################################################################################## removing package lib64mnl-devel-1.0.5-1.mga9.x86_64 7/19: removing lib64mnl-devel-1.0.5-1.mga9.x86_64 ################################################################################################## removing package lib64xml2-devel-2.10.4-1.2.mga9.x86_64 8/19: removing lib64xml2-devel-2.10.4-1.2.mga9.x86_64 ################################################################################################## removing package lib64python3-devel-3.10.11-1.2.mga9.x86_64 9/19: removing lib64python3-devel-3.10.11-1.2.mga9.x86_64 ################################################################################################## removing package gnutls-3.8.4-1.mga9.x86_64 10/19: removing gnutls-3.8.4-1.mga9.x86_64 ################################################################################################## removing package lib64python3.10-testsuite-3.10.11-1.2.mga9.x86_64 11/19: removing lib64python3.10-testsuite-3.10.11-1.2.mga9.x86_64 ################################################################################################## removing package lib64p11-kit-devel-0.24.1-2.mga9.x86_64 12/19: removing lib64p11-kit-devel-0.24.1-2.mga9.x86_64 ################################################################################################## removing package lib64ffi-devel-3.4.4-1.mga9.x86_64 13/19: removing lib64ffi-devel-3.4.4-1.mga9.x86_64 ################################################################################################## removing package python3-docs-3.10.11-1.2.mga9.noarch 14/19: removing python3-docs-3.10.11-1.2.mga9.noarch ################################################################################################## removing package tkinter3-3.10.11-1.2.mga9.x86_64 15/19: removing tkinter3-3.10.11-1.2.mga9.x86_64 ################################################################################################## removing package lib64gnutls-dane0-3.8.4-1.mga9.x86_64 16/19: removing lib64gnutls-dane0-3.8.4-1.mga9.x86_64 ################################################################################################## removing package libtasn1-tools-4.19.0-1.mga9.x86_64 17/19: removing libtasn1-tools-4.19.0-1.mga9.x86_64 ################################################################################################## removing package lib64gnutlsxx30-3.8.4-1.mga9.x86_64 18/19: removing lib64gnutlsxx30-3.8.4-1.mga9.x86_64 ################################################################################################## removing package lib64ublksrv0-1.0-3.mga9.x86_64 19/19: removing lib64ublksrv0-1.0-3.mga9.x86_64 ################################################################################################## Not problems found in that area
Mageia9, x64 Installed the core packages and then updated via qarepo and drakrpm-update. $ nbdsh Welcome to nbdsh, the shell for interacting with Network Block Device (NBD) servers. The ‘nbd’ module has already been imported and there is an open NBD handle called ‘h’ in state 'START'. h.connect_tcp("remote", "10809") # Connect to a remote server. h.get_size() # Get size of the remote disk. buf = h.pread(512, 0) # Read the first sector. exit() or Ctrl-D # Quit the shell help(nbd) # Display documentation nbd> help(nbd) The documentation leads to information about the python API. Taking the script above at face value, tried running it but that failed, implying that the nbd module had NOT been set up: nbd> h.connect_tcp("canopus", "10809") Traceback (most recent call last): File "<console>", line 1, in <module> NameError: name 'h' is not defined nbd> $ cat /etc/services | grep nbd nbd 10809/tcp # Linux Network Block Device The same result on the remote PC. The man page offers a different format for the connection which treats a slice of RAM as a target, reports its size then copies a bytestring to it. Tried that as well but h comes back as undefined again so it looks like the shell does not set things up automatically. It may be that the documentation is stating an assumption that the user has already taken care of h. I am at a loss at this stage to see the way forward apart from poking around on the web.
In reply to Len Lawrence in comment 6: Further along in the man page for nbdsh there is this: -n Do not create the implicit handle "h". which does suggest that invoking the shell should create the h module. Unfortunately I did not try the command before updating. Back later after trying the pre-update on the remote machine.
Before that: $ nbdsh -n Welcome to nbdsh, the shell for interacting with Network Block Device (NBD) servers. The ‘nbd’ module has already been imported. h = nbd.NBD() # Create a new handle. h.connect_tcp("remote", "10809") # Connect to a remote server. h.get_size() # Get size of the remote disk. buf = h.pread(512, 0) # Read the first sector. exit() or Ctrl-D # Quit the shell help(nbd) # Display documentation nbd> h = nbd.NBD() nbd> h.connect_tcp("canopus", "10809") Traceback (most recent call last): File "<console>", line 1, in <module> File "/usr/lib64/python3.10/site-packages/nbd.py", line 1682, in connect_tcp return libnbdmod.connect_tcp(self._o, hostname, port) nbd.Error: nbd_connect_tcp: recv: Connection refused (ECONNREFUSED) nbd>
Continuing from comment 8: Tried another example. $ nbdsh [...] nbd> e = nbd.NBD() nbd> e.connect_command(["whatever", "-s", "memory", "1G"])whatever: Permission denied Traceback (most recent call last): File "<console>", line 1, in <module> File "/usr/lib64/python3.10/site-packages/nbd.py", line 1738, in connect_command return libnbdmod.connect_command(self._o, argv) nbd.Error: nbd_connect_command: recv: server disconnected unexpectedly Repeated that sequence without creating an empty file: nbd> p = nbd.NBD() nbd> p.connect_command(["./testfile", "-s", "memory", "1G"]) ./testfile: No such file or directory Traceback (most recent call last): File "<console>", line 1, in <module> File "/usr/lib64/python3.10/site-packages/nbd.py", line 1738, in connect_command return libnbdmod.connect_command(self._o, argv) nbd.Error: nbd_connect_command: recv: server disconnected unexpectedly So the file must already exist. The one used earlier had write permission across the board. It looks like there is much more to this than the manual tells us so I shall have to abandon the "simple" tests. Have to pass it on the basis of a clean update.
Whiteboard: (none) => MGA9-64-OK
CC: (none) => andrewsfarm
A valiant effort, Len. It does read to me like a situation of user inexperience, rather than a problem with the update itself. Validating.
CC: (none) => sysadmin-bugsKeywords: (none) => validated_update
Aye, user inexperience is a major factor in at least half of the software we deal with.
I've noticed that. ;-)
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0174.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED