CVE-2019-14850: 
NixOS vulnerability analysis and mitigation

A denial of service vulnerability was discovered in nbdkit versions 1.12.7, 1.14.1, and 1.15.1. The vulnerability allows an attacker to connect to the nbdkit service and cause it to perform excessive work in initializing backend plugins by simply opening a connection to the service (NVD, Debian Tracker).

The vulnerability is classified as a network amplification issue (CWE-406) where a small amount of work by the attacker (opening TCP connections without sending data) can trigger significant resource consumption on the server side. The vulnerability has a CVSS v3.1 base score of 3.7 (LOW) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating network accessibility with high attack complexity and low availability impact (NVD).

The vulnerability could cause resource consumption and degradation of service in nbdkit, with the severity depending on the plugins configured on the server-side. Plugins such as nbdkit-ssh-plugin and nbdkit-guestfs-plugin are particularly vulnerable as they perform substantial work in their initial .open() callback, such as connecting to remote machines or launching small VMs (Red Hat Bugzilla).

The vulnerability is exploitable by attackers who can connect to the nbdkit service's TCP port. Even when TLS is configured for client authentication, unauthorized clients can exploit this vulnerability by simply opening TCP connections. The effectiveness of the attack depends on the specific plugin configuration on the server (Red Hat Bugzilla).

Several mitigation strategies are available: using nbdkit with Unix domain sockets (nbdkit -U) instead of TCP, binding only to private network interfaces, implementing firewall rules to restrict access, or using plugins that perform minimal work in their .open() callback (such as nbdkit-memory-plugin). The vulnerability has been fixed in subsequent versions of nbdkit (Red Hat Bugzilla).