CVE-2023-5215: redhat enterprise_linux
Vulnerability summary
CVE-2023-5215 is a medium (CVSS 6.5) vulnerability in redhat enterprise_linux. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 28-09-2023PublishedVulnerability first disclosed.
- 08-11-2025Last modifiedVulnerability information updated.
Description
A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.81%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
+0.06 pp
From 0.75% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (listman.redhat.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-241Improper Handling of Unexpected Data TypeThe product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
- CWE-252Unchecked Return ValueThe product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Affected systems
Opensuse3 products
- libnbd&distro=openSUSE Leap 15.4< 1.18.1-150300.8.15.1
- libnbd&distro=openSUSE Leap 15.5< 1.18.1-150300.8.15.1
- libnbd&distro=openSUSE Tumbleweed< 1.18.0-1.1
Redhat2 products
- enterprise_linux8.0 | 9.0
- libnbd< 1.18.0
Debian1 product
- libnbdAll versions (No fix recorded) | < 1.16.5-1
Mageia1 product
- libnbd< 1.15.8-3.1.mga9
Ubuntu1 product
- libnbdAll versions (No fix recorded)
5 vendors · 8 products
