CVE-2022-0485

    Dashboard / Vulnerabilities / CVE-2022-0485

    CVE-2022-0485

    Published: 29 Aug 2022Last Modified: 22 Oct 2026

    Summary:

    Details: A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as successful, rather than checking the *error parameter. This could result in the silent creation of a corrupted destination image.

    References: https://access.redhat.com/security/cve/CVE-2022-0485, https://listman.redhat.com/archives/libguestfs/2022-February/msg00104.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0485.json, https://nvd.nist.gov/vuln/detail/CVE-2022-0485, https://bugzilla.redhat.com/show_bug.cgi?id=2046194, https://bugzilla.redhat.com/show_bug.cgi?id=2050324, https://gitlab.com/nbdkit/libnbd/-/commit/8d444b41d09a700c7ee6f9182a649f3f2d325abb

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 58e0c284e5ebcff101cd3b1f8fc7232f68202b66
    Fixed -8d444b41d09a700c7ee6f9182a649f3f2d325abb

    Affected versions

    Fixed in libnbd v1.11.8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High