CVE-2025-47711
BaseFortify
Publication date: 2025-06-09
Last updated on: 2025-08-26
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | enterprise_linux_advanced_virtualization | 8.0 |
| nbdkit_project | nbdkit | * |
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-193 | A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an off-by-one error in the nbdkit server when it processes block status results from its plugins. If an NBD client requests block status for the maximum 32-bit length and the plugin responds with a single data block larger than this maximum, the nbdkit server triggers an assertion failure. This causes the server to crash or become unresponsive. [1]
How can this vulnerability impact me? :
The vulnerability can be exploited by a compliant client to cause a denial-of-service (DoS) condition. This means the nbdkit server can crash or become unresponsive, preventing it from serving other clients and disrupting service availability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the nbdkit server for crashes or assertion failures when handling block status requests from clients. Specifically, look for logs indicating assertion failures related to block status extents exceeding the maximum 32-bit length. Network traffic analysis could focus on NBD client requests for very large data ranges (maximum 32-bit length). However, no specific detection commands are provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or monitoring NBD client requests to prevent requests for excessively large data ranges that could trigger the vulnerability. Applying any available patches or updates to nbdkit from your Linux distribution vendor is recommended once released. Additionally, consider limiting access to the nbdkit server to trusted clients only to reduce the risk of exploitation. [1]