CVE-2019-14842

Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed to test for chunk offsets smaller than the beginning of the request did not work because of signed/unsigned confusion. If one of these chunks contains a negative offset then data under control of the server is written to memory before the read buffer supplied by the client. If the read buffer is located on the stack then this allows the stack return address from nbd_pread() to be trivially modified, allowing arbitrary code execution under the control of the server. If the buffer is located on the heap then other memory objects before the buffer can be overwritten, which again would usually lead to arbitrary code execution.

• CWE-681
• CWE-681

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14842Issue Tracking, Third Party Advisory
• https://www.redhat.com/archives/libguestfs/2019-October/msg00060.htmlPatch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14842Issue Tracking, Third Party Advisory
• https://www.redhat.com/archives/libguestfs/2019-October/msg00060.htmlPatch, Third Party Advisory

Published

Nov 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14837A flaw was found in keycloack before version 8.0.0. The owne…9.1
• CVE-2019-14838A flaw was found in wildfly-core before 7.2.5.GA. The Manage…4.9
• CVE-2019-14839It was observed that while login into Business-central conso…7.5
• CVE-2019-1484A remote code execution vulnerability exists when Microsoft …7.8
• CVE-2019-14840A flaw was found in the RHDM, where sensitive HTML form fiel…7.5
• CVE-2019-14841A flaw was found in the RHDM, where an authenticated attacke…8.8
• CVE-2019-14843A flaw was found in Wildfly Security Manager, running under …8.8
• CVE-2019-14844A flaw was found in, Fedora versions of krb5 from 1.16.1 to,…7.5
• CVE-2019-14845A vulnerability was found in OpenShift builds, versions 4.1 …5.3
• CVE-2019-14846In Ansible, all Ansible Engine versions up to ansible-engine…7.8
• CVE-2019-14847A flaw was found in samba 4.0.0 before samba 4.9.15 and samb…4.9
• CVE-2019-14848Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…