Re: [PATCH v3 5/6] nbd/server: Reject rather than assert on non-compliant NBD_OPT_SET_META_CONTEXT

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Nov 10, 2026 at 09:54:01AM -0600, Eric Blake wrote:
> The NBD protocol says that NBD_OPT_{LIST,SET}_META_CONTEXT sends
> several lengths that must be consistent: an overall option reply
> length, then a series of smaller lengths/data pairs representing the
> export name and zero or more context names. If the smaller lengths
> within the payload do not add up to the larger value, the client has
> sent garbage bytes that will trigger the server's parse of the
> client's next option to be out of sync.  However, QEMU was dying with
> an assertion failure rather than diagnosing the issue, which a
> malicious client can then exploit to mount a denial-of-service attack
> against QEMU as the NBD server.
> 
> As with several other recent NBD protocol violations, the likelihood
> of this attack can be reduced by using TLS and x509 certs to reject
> unwanted clients (a "trusted" client can still trigger the problem,
> but you first have to compromise the trusted client into sending
> arbitrary traffic).
> 
> Fixes: CVE-2026-125683
> Fixes: e7b1948d51 ("nbd: BLOCK_STATUS for standard get_block_status function: server part", v2.12.0)
> Reported-by: TonySD via https://gitlab.com/qemu-project/qemu/-/work_items/4843
> CC: qemu-stable@nongnu.org
> Signed-off-by: Eric Blake <eblake@redhat.com>
> ---
>  nbd/server.c | 5 +++++
>  1 file changed, 5 insertions(+)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|