CVE-2025-47712

A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-47712	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2365724	Issue Tracking Third Party Advisory
https://lists.libguestfs.org/archives/list/[email protected]/thread/67E7AASHHADIY7VAD3FFW2I67LTWVWYF/	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:nbdkit_project:nbdkit:-:*:*:*:*:*:*:*

OR	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:10.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_advanced_virtualization:8.0:::::::*

History

No history.

Information

Published : 2025-06-09 06:15

Updated : 2025-08-21 01:19

NVD link : CVE-2025-47712

Mitre link : CVE-2025-47712

CVE.ORG link : CVE-2025-47712

JSON object : View

Products Affected

redhat

enterprise_linux
enterprise_linux_advanced_virtualization

nbdkit_project

nbdkit

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2025-47712", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-06-09T06:15:25.537", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-47712", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365724", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://lists.libguestfs.org/archives/list/[email protected]/thread/67E7AASHHADIY7VAD3FFW2I67LTWVWYF/", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "A flaw exists in the nbdkit \"blocksize\" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service."}, {"lang": "es", "value": "Existe una falla en el filtro \"blocksize\" de nbdkit que puede activarse con un tipo espec\u00edfico de solicitud de cliente. Cuando un cliente solicita informaci\u00f3n sobre el estado del bloque para un rango de datos muy grande, superando cierto l\u00edmite, se produce un error interno en nbdkit, lo que provoca una denegaci\u00f3n de servicio."}], "lastModified": "2025-08-21T01:19:08.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nbdkit_project:nbdkit:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5312E2C-4BD8-45EE-8D28-6ED75541E48B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_advanced_virtualization:8.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A4A47F8A-43BF-44A4-A465-14C7653BC11E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}