Re: [PATCH v3 3/6] nbd/server: Reject rather than assert on non-compliant BLOCK_STATUS

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Nov 10, 2026 at 09:53:59AM -0600, Eric Blake wrote:
> The NBD spec is clear that a client must not send NBD_BLOCK_STATUS
> requests to a server if it did not negotiate any metacontexts with
> NBD_OPT_SET_META_CONTEXT for the current export.  However, if the
> non-compliant client uses NBD_OPT_EXTENDED_HEADERS and then passes in
> the relatively new NBD_CMD_FLAG_PAYLOAD_LEN flag alongside an
> inappropriate block status request, this was enough to trigger an
> assertion in qemu.  The assertion can also be tripped by initially
> requesting the context for one export, then using NBD_OPT_GO on a
> different export (nbd_check_meta_export() sets contexts.count to 0,
> but did not wipe contexts.exp). Forcing the client command to be
> rejected if contexts.count is 0 solves both triggers, and allows the
> assertion to still operate cleanly at a later location.
> 
> If you do not use recommended practice to prevent unwanted clients
> from connecting to QEMU's NBD server, then any client can cause a
> denial of service with minimal effort.  However, with TLS and x509
> certs in place, an attacker must first chain in an attack to convince
> the client to send unwanted traffic, which is a factor in declaring
> this a lower-risk denial of service.
> 
> Fixes: CVE-2026-124559
> Fixes: 2dcbb11b ("nbd/server: Add FLAG_PAYLOAD support to CMD_BLOCK_STATUS", v8.2.0)
> Reported-by: Feifan Qian <bea1e@proton.me>
> Reported-by: https://gitlab.com/qemu-project/qemu/-/work_items/3796
> CC: Haotian Jiang <jianghaotian.sunday@gmail.com>
> CC: qemu-stable@nongnu.org
> Signed-off-by: Eric Blake <eblake@redhat.com>
> 
> ---
> v3: Move assert later rather than dropping it; improve commit message.
> R-b dropped.
> ---
>  nbd/server.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|