Description
In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket supported a shutdown() method. Explicitely accept TCP and UNIX stream sockets.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
cf1b2326b734896734c6e167e41766f9cee7686a to < c365e8f20f4201d873a70385bd919f0fb531e960affectedcf1b2326b734896734c6e167e41766f9cee7686a to < 4f9e6ff6319dbcebea64b50af0304cf0ad7e97e7affectedcf1b2326b734896734c6e167e41766f9cee7686a to < 37ad11f20e164c23ce827dd455b42c0fdd29685caffectedcf1b2326b734896734c6e167e41766f9cee7686a to < 808e2335bc1cf2293b9e36ccc94c267c81509c71affectedcf1b2326b734896734c6e167e41766f9cee7686a to < 9f7c02e031570e8291a63162c6c046dc15ff85b0affected4df728651b8a99693c69962d8e5a5b9e5a3bbcc7affected083322455c67d278c56a66b73f1221f004ee600aaffected4fa1cbd587ef967812f9d9f6ce46ec1dead7502caffected4.14.152 to < 4.15affected4.19.82 to < 4.20affected5.3.9 to < 5.4affected
Linux Linux
Default version status: affected
5.4affected0 to < 5.4unaffected6.1.156 to ≤ 6.1.*unaffected6.6.112 to ≤ 6.6.*unaffected6.12.53 to ≤ 6.12.*unaffected6.17.3 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c365e8f20f4201d873a70385bd919f0fb531e960 ↗
- https://git.kernel.org/stable/c/4f9e6ff6319dbcebea64b50af0304cf0ad7e97e7 ↗
- https://git.kernel.org/stable/c/37ad11f20e164c23ce827dd455b42c0fdd29685c ↗
- https://git.kernel.org/stable/c/808e2335bc1cf2293b9e36ccc94c267c81509c71 ↗
- https://git.kernel.org/stable/c/9f7c02e031570e8291a63162c6c046dc15ff85b0 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗