4.8
Medium
CVE-2025-14946 Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri
Description
A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:LExploitable with local access to the machine, with an ordinary account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| libnbd 1.23 | 1.23.0 → < 1.23.9 | 1.23.9 |
| libnbd 1.22 | 1.22.0 → < 1.22.5 | 1.22.5 |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published |