nbdkit Blocksize Filter Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the nbdkit blocksize filter. When a client requests block status for a very large data range, exceeding a specific limit, it causes an internal error in nbdkit. This issue arises because the blocksize filter uses a 32-bit variable, which can lead to an integer overflow. Requests larger than approximately 4 gigabytes wrap around to zero, triggering an assertion failure and causing a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to an assertion failure in nbdkit, causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send a block status request through the nbdkit blocksize filter that exceeds the limit of (2**32 - the minimum blocksize). The request will be rounded up to 4 gigabytes, causing an integer overflow that wraps around to zero and triggers an assertion failure.