Skip to content

Commit 94f44bd

Browse files
durgajagadeeshdurgajagadeesh
authored
[Medium] Patch nbdkit for CVE-2025-47711 & CVE-2025-47712 (#14032)
1 parent a83d48d commit 94f44bd

File tree

3 files changed

+271
-1
lines changed

3 files changed

+271
-1
lines changed

‎SPECS/nbdkit/CVE-2025-47711.patch

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
From 9457616cacdb044aa1773d7a931cdfeea77b1057 Mon Sep 17 00:00:00 2001
2+
From: dj_palli <[email protected]>
3+
Date: Wed, 18 Jun 2025 14:40:17 +0000
4+
Subject: [PATCH] Address CVE-2025-47711
5+
6+
Upstream patch reference: https://gitlab.com/nbdkit/nbdkit/-/commit/c3c1950867ea8d9c2108ff066ed9e78dde3cfc3f
7+
---
8+
server/protocol.c | 2 +-
9+
tests/Makefile.am | 2 ++
10+
tests/test-eval-extents.sh | 71 ++++++++++++++++++++++++++++++++++++++
11+
3 files changed, 74 insertions(+), 1 deletion(-)
12+
create mode 100644 tests/test-eval-extents.sh
13+
14+
diff --git a/server/protocol.c b/server/protocol.c
15+
index d9a5e28..c32fec8 100644
16+
--- a/server/protocol.c
17+
+++ b/server/protocol.c
18+
@@ -493,7 +493,7 @@ extents_to_block_descriptors (struct nbdkit_extents *extents,
19+
(*nr_blocks)++;
20+
21+
pos += length;
22+
- if (pos > offset + count) /* this must be the last block */
23+
+ if (pos >= offset + count) /* this must be the last block */
24+
break;
25+
26+
/* If we reach here then we must have consumed this whole
27+
diff --git a/tests/Makefile.am b/tests/Makefile.am
28+
index 9233c37..a1905c9 100644
29+
--- a/tests/Makefile.am
30+
+++ b/tests/Makefile.am
31+
@@ -781,6 +781,7 @@ TESTS += \
32+
test-eval.sh \
33+
test-eval-file.sh \
34+
test-eval-exports.sh \
35+
+ test-eval-extents.sh \
36+
test-eval-cache.sh \
37+
test-eval-dump-plugin.sh \
38+
test-eval-disconnect.sh \
39+
@@ -789,6 +790,7 @@ EXTRA_DIST += \
40+
test-eval.sh \
41+
test-eval-file.sh \
42+
test-eval-exports.sh \
43+
+ test-eval-extents.sh \
44+
test-eval-cache.sh \
45+
test-eval-dump-plugin.sh \
46+
test-eval-disconnect.sh \
47+
diff --git a/tests/test-eval-extents.sh b/tests/test-eval-extents.sh
48+
new file mode 100644
49+
index 0000000..92b503e
50+
--- /dev/null
51+
+++ b/tests/test-eval-extents.sh
52+
@@ -0,0 +1,71 @@
53+
+#!/usr/bin/env bash
54+
+# nbdkit
55+
+# Copyright Red Hat
56+
+#
57+
+# Redistribution and use in source and binary forms, with or without
58+
+# modification, are permitted provided that the following conditions are
59+
+# met:
60+
+#
61+
+# * Redistributions of source code must retain the above copyright
62+
+# notice, this list of conditions and the following disclaimer.
63+
+#
64+
+# * Redistributions in binary form must reproduce the above copyright
65+
+# notice, this list of conditions and the following disclaimer in the
66+
+# documentation and/or other materials provided with the distribution.
67+
+#
68+
+# * Neither the name of Red Hat nor the names of its contributors may be
69+
+# used to endorse or promote products derived from this software without
70+
+# specific prior written permission.
71+
+#
72+
+# THIS SOFTWARE IS PROVIDED BY RED HAT AND CONTRIBUTORS ''AS IS'' AND
73+
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
74+
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
75+
+# PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RED HAT OR
76+
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
77+
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
78+
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
79+
+# USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
80+
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
81+
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
82+
+# OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
83+
+# SUCH DAMAGE.
84+
+
85+
+source ./functions.sh
86+
+set -e
87+
+set -x
88+
+
89+
+requires_run
90+
+requires_plugin eval
91+
+requires_nbdsh_uri
92+
+requires nbdsh --base-allocation --version
93+
+
94+
+files="eval-extents.out"
95+
+rm -f $files
96+
+cleanup_fn rm -f $files
97+
+
98+
+# Trigger an off-by-one bug introduced in v1.11.10 and fixed in v1.43.7
99+
+export script='
100+
+def f(context, offset, extents, status):
101+
+ print(extents)
102+
+
103+
+# First, probe where the server should return 2 extents.
104+
+h.block_status(2**32-1, 2, f)
105+
+
106+
+# Next, probe where the server has exactly 2**32-1 bytes in its first extent.
107+
+h.block_status(2**32-1, 1, f)
108+
+
109+
+# Now, probe where the first extent has to be truncated.
110+
+h.block_status(2**32-1, 0, f)
111+
+'
112+
+nbdkit eval \
113+
+ get_size='echo 5G' \
114+
+ pread='dd if=/dev/zero count=$3 iflag=count_bytes' \
115+
+ extents='echo 0 4G 1; echo 4G 1G 2' \
116+
+ --run 'nbdsh --base-allocation --uri "$uri" -c "$script"' \
117+
+ > eval-extents.out
118+
+cat eval-extents.out
119+
+diff -u - eval-extents.out <<EOF
120+
+[4294967294, 1, 1073741824, 2]
121+
+[4294967295, 1]
122+
+[4294967295, 1]
123+
+EOF
124+
--
125+
2.45.2
126+

‎SPECS/nbdkit/CVE-2025-47712.patch

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
From 93e521b7d705202335c4147218181b0bdd1e7cb0 Mon Sep 17 00:00:00 2001
2+
From: dj_palli <[email protected]>
3+
Date: Wed, 18 Jun 2025 16:11:18 +0000
4+
Subject: [PATCH] Address CVE-2025-47712
5+
6+
Upstream patch reference: https://gitlab.com/nbdkit/nbdkit/-/commit/a486f88d1eea653ea88b0bf8804c4825dab25ec7
7+
---
8+
filters/blocksize/blocksize.c | 3 +-
9+
tests/Makefile.am | 2 +
10+
tests/test-blocksize-extents-overflow.sh | 83 ++++++++++++++++++++++++
11+
3 files changed, 87 insertions(+), 1 deletion(-)
12+
create mode 100644 tests/test-blocksize-extents-overflow.sh
13+
14+
diff --git a/filters/blocksize/blocksize.c b/filters/blocksize/blocksize.c
15+
index 09195ce..d3fcb4b 100644
16+
--- a/filters/blocksize/blocksize.c
17+
+++ b/filters/blocksize/blocksize.c
18+
@@ -482,7 +482,8 @@ blocksize_extents (nbdkit_next *next,
19+
return -1;
20+
}
21+
22+
- if (nbdkit_extents_aligned (next, MIN (ROUND_UP (count, h->minblock),
23+
+ if (nbdkit_extents_aligned (next,
24+
+ MIN (ROUND_UP ((uint64_t) count, h->minblock),
25+
h->maxlen),
26+
ROUND_DOWN (offset, h->minblock), flags,
27+
h->minblock, extents2, err) == -1)
28+
diff --git a/tests/Makefile.am b/tests/Makefile.am
29+
index a1905c9..dc8445f 100644
30+
--- a/tests/Makefile.am
31+
+++ b/tests/Makefile.am
32+
@@ -1483,12 +1483,14 @@ test_layers_filter3_la_LIBADD = $(IMPORT_LIBRARY_ON_WINDOWS)
33+
TESTS += \
34+
test-blocksize.sh \
35+
test-blocksize-extents.sh \
36+
+ test-blocksize-extents-overflow.sh \
37+
test-blocksize-default.sh \
38+
test-blocksize-sharding.sh \
39+
$(NULL)
40+
EXTRA_DIST += \
41+
test-blocksize.sh \
42+
test-blocksize-extents.sh \
43+
+ test-blocksize-extents-overflow.sh \
44+
test-blocksize-default.sh \
45+
test-blocksize-sharding.sh \
46+
$(NULL)
47+
diff --git a/tests/test-blocksize-extents-overflow.sh b/tests/test-blocksize-extents-overflow.sh
48+
new file mode 100644
49+
index 0000000..844c399
50+
--- /dev/null
51+
+++ b/tests/test-blocksize-extents-overflow.sh
52+
@@ -0,0 +1,83 @@
53+
+#!/usr/bin/env bash
54+
+# nbdkit
55+
+# Copyright Red Hat
56+
+#
57+
+# Redistribution and use in source and binary forms, with or without
58+
+# modification, are permitted provided that the following conditions are
59+
+# met:
60+
+#
61+
+# * Redistributions of source code must retain the above copyright
62+
+# notice, this list of conditions and the following disclaimer.
63+
+#
64+
+# * Redistributions in binary form must reproduce the above copyright
65+
+# notice, this list of conditions and the following disclaimer in the
66+
+# documentation and/or other materials provided with the distribution.
67+
+#
68+
+# * Neither the name of Red Hat nor the names of its contributors may be
69+
+# used to endorse or promote products derived from this software without
70+
+# specific prior written permission.
71+
+#
72+
+# THIS SOFTWARE IS PROVIDED BY RED HAT AND CONTRIBUTORS ''AS IS'' AND
73+
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
74+
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
75+
+# PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RED HAT OR
76+
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
77+
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
78+
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
79+
+# USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
80+
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
81+
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
82+
+# OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
83+
+# SUCH DAMAGE.
84+
+
85+
+# Demonstrate a fix for a bug where blocksize overflowed 32 bits
86+
+
87+
+source ./functions.sh
88+
+set -e
89+
+set -x
90+
+
91+
+requires_run
92+
+requires_plugin eval
93+
+requires_nbdsh_uri
94+
+requires nbdsh --base-allocation --version
95+
+
96+
+# Script a sparse server that requires 512-byte aligned requests.
97+
+exts='
98+
+if test $(( ($3|$4) & 511 )) != 0; then
99+
+ echo "EINVAL request unaligned" 2>&1
100+
+ exit 1
101+
+fi
102+
+echo 0 5G 0
103+
+'
104+
+
105+
+# We also need an nbdsh script to parse all extents, coalescing adjacent
106+
+# types for simplicity.
107+
+# FIXME: Once nbdkit plugin version 3 allows 64-bit block extents, run
108+
+# this test twice, once for each bit size (32-bit needs 2 extents, 64-bit
109+
+# will get the same result with only 1 extent).
110+
+export script='
111+
+size = h.get_size()
112+
+offs = 0
113+
+entries = []
114+
+def f(metacontext, offset, e, err):
115+
+ global entries
116+
+ global offs
117+
+ assert offs == offset
118+
+ for length, flags in zip(*[iter(e)] * 2):
119+
+ if entries and flags == entries[-1][1]:
120+
+ entries[-1] = (entries[-1][0] + length, flags)
121+
+ else:
122+
+ entries.append((length, flags))
123+
+ offs = offs + length
124+
+
125+
+# Test a loop over the entire device
126+
+while offs < size:
127+
+ len = min(size - offs, 2**32-1)
128+
+ h.block_status(len, offs, f)
129+
+assert entries == [(5 * 2**30, 0)]
130+
+'
131+
+
132+
+# Now run everything
133+
+nbdkit --filter=blocksize eval minblock=512 \
134+
+ get_size='echo 5G' pread='exit 1' extents="$exts" \
135+
+ --run 'nbdsh --base-allocation -u "$uri" -c "$script"'
136+
--
137+
2.45.2
138+

‎SPECS/nbdkit/nbdkit.spec

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ Distribution: Mariner
5151

5252
Name: nbdkit
5353
Version: 1.35.3
54-
Release: 3%{?dist}
54+
Release: 4%{?dist}
5555
Summary: NBD server
5656

5757
License: BSD
@@ -128,6 +128,8 @@ Requires: nbdkit-server%{?_isa} = %{version}-%{release}
128128
Requires: nbdkit-basic-plugins%{?_isa} = %{version}-%{release}
129129
Requires: nbdkit-basic-filters%{?_isa} = %{version}-%{release}
130130

131+
Patch0: CVE-2025-47711.patch
132+
Patch1: CVE-2025-47712.patch
131133

132134
%description
133135
NBD is a protocol for accessing block devices (hard disks and
@@ -1193,6 +1195,10 @@ export LIBGUESTFS_TRACE=1
11931195

11941196

11951197
%changelog
1198+
* Wed Jun 18 2025 Durga Jagadeesh Palli <[email protected]> - 1.35.3-4
1199+
- add patch for CVE-2025-47711.patch
1200+
- add patch for CVE-2025-47712.patch
1201+
11961202
* Wed Sep 20 2023 Jon Slobodzian <[email protected]> - 1.35.3-3
11971203
- Recompile with stack-protection fixed gcc version (CVE-2023-4039)
11981204

0 commit comments

Comments
 (0)