Re: [PATCH v2 2/3] nbd/server: Reject rather than assert on non-compliant BLOCK_STATUS

[Eric Blake <eblake@redhat.com>]

On Sat, Nov 07, 2026 at 04:54:37PM -0600, Eric Blake wrote:
> The NBD spec is clear that a client must not send NBD_BLOCK_STATUS
> requests to a server if it did not negotiate any metacontexts with
> NBD_OPT_SET_META_CONTEXT.  However, if the non-compliant client uses
> NBD_OPT_EXTENDED_HEADERS and then passes in the relatively new
> NBD_CMD_FLAG_PAYLOAD_LEN flag alongside an inappropriate block status
> request, this was enough to trigger an assertion in qemu.
> 
> If you do not use recommended practice to prevent untrusted clients
> from connecting to QEMU's NBD server, then you are at risk of a denial
> of service attack from a rogue client.  Per our stated policy on flaws
> triggered by network connections, this is considered a low-severity
> security flaw, since it is trivial to avoid by using proper
> configuration of TLS and x509 certificate authorization to reject
> rogue clients; therefore, no CVE has been assigned yet.

CVE-2026-124559 has been assigned; I'll update the commit message
accordingly before the pull request, if no other changes in the series
are requested.

> 
> Fixes: 2dcbb11b ("nbd/server: Add FLAG_PAYLOAD support to CMD_BLOCK_STATUS", v8.2.0)
> Reported-by: Feifan Qian <bea1e@proton.me>
> Reported-by: https://gitlab.com/qemu-project/qemu/-/work_items/3796
> CC: Haotian Jiang <jianghaotian.sunday@gmail.com>
> CC: qemu-stable@nongnu.org
> Signed-off-by: Eric Blake <eblake@redhat.com>
> ---
>  nbd/server.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/nbd/server.c b/nbd/server.c
> index e6c47f8c2e3..bc37cbcb338 100644
> --- a/nbd/server.c
> +++ b/nbd/server.c
> @@ -2584,12 +2584,12 @@ nbd_co_block_status_payload_read(NBDClient *client, NBDRequest *request,
>          return -EINVAL;
>      }
> 
> -    assert(client->contexts.exp == client->exp);
>      nr_bitmaps = client->exp->nr_export_bitmaps;
>      request->contexts = g_new0(NBDMetaContexts, 1);
>      request->contexts->exp = client->exp;
> 
> -    if (payload_len % sizeof(uint32_t) ||
> +    if (!client->contexts.count ||
> +        payload_len % sizeof(uint32_t) ||
>          payload_len < sizeof(NBDBlockStatusPayload) ||
>          payload_len > (sizeof(NBDBlockStatusPayload) +
>                         sizeof(id) * client->contexts.count)) {
> -- 
> 2.56.0
> 
> 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.
Virtualization:  qemu.org | libguestfs.org