[Libguestfs] [NBDKIT SECURITY] Denial of Service / Amplification Attack in nbdkit
Richard W.M. Jones
rjones at redhat.com
Thu Sep 12 17:41:35 UTC 2019
We have discovered a potential Denial of Service / Amplification Attack
Reported: 2019-09-11 Fixed: 2019-09-11 Published: 2019-09-12
There is no CVE number assigned for this issue yet, but the bug is
being categorized and processed by Red Hat's security team which may
result in a CVE being published later.
Reported and patched by Richard W.M. Jones <rjones at redhat.com>.
Reviewed by Eric Blake <eblake at redhat.com> and
Daniel Berrangé <berrange at redhat.com>.
nbdkit is a Network Block Device (NBD) server with multiple plugins.
An attacker, by connecting to nbdkit’s TCP port, is able to make the
current plugin’s .open() callback run. For some plugins this callback
does a considerable amount of work, for example connecting to a remote
machine (nbdkit-ssh-plugin) or launching a small VM
(nbdkit-guestfs-plugin). Thus for a small amount of work done by the
attacker (opening many TCP connections but not sending any data), a
large amount of work is done by nbdkit (eg. making many full ssh
connections to a remote machine or launching hundreds of VMs).
A related problem is that if nbdkit is configured to use TLS for
client authentication, even clients which are not authorized are able
to attack nbdkit in this way because all they have to do is open a TCP
Mitigating this is that the current plugin is NOT selected by the
attacker, but is part of the server configuration. Therefore the
effectiveness of the attack depends on the particular configuration.
There are two situations in which you will NOT be affected:
* You are not exposing nbdkit over TCP (eg. using nbdkit -U), or the
TCP port is not accessible to untrusted attackers (eg. private LAN,
* The plugin you are using does not do much work in its .open()
callback. For example the memory plugin does nothing in its
callback so is not vulnerable:
Test if nbdkit is a vulnerable version
Run the following command (requires bash):
nbdkit -fv null --run 'sleep 1 >/dev/tcp/localhost/10809' 2>&1 |
grep -q 'open readonly' && echo vulnerable || echo patched
It is recommended to upgrade to a fixed version of nbdkit (see next
section). However if this cannot be done, apply network filtering
(eg. firewall, TCP wrappers, etc.) to ensure that untrusted clients
cannot connect to nbdkit’s public TCP port. Or use a Unix domain
socket instead of a loopback TCP connection.
This affects all versions of nbdkit. A fix is available for 1.12,
1.14 and the current development branch.
* development branch (1.15)
or use nbdkit >= 1.15.1 from
* stable branch 1.14
or use nbdkit >= 1.14.1 from
* stable branch 1.12
or use nbdkit >= 1.12.7 from
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine. Supports Linux and Windows.
More information about the Libguestfs