CVE-2019-14851: 
NixOS vulnerability analysis and mitigation

A denial of service vulnerability was discovered in nbdkit, identified as CVE-2019-14851. The vulnerability affects specific versions of nbdkit (1.12.7, 1.14.1, and 1.15.1) where a client issuing certain commands in an incorrect sequence could trigger an assertion failure, causing the service to exit (CVE Mitre, Debian Tracker).

The vulnerability was introduced as a side effect of fixing another security issue. When a client issues an NBD_OPT_INFO command before NBD_OPT_GO, it triggers back-to-back calls to the open() callback, leading to an assertion failure because the first open() did not have a matching close() operation (Red Hat Bugzilla).

When successfully exploited, this vulnerability results in a denial of service condition by causing nbdkit to exit unexpectedly. While no known nbdkit clients exhibited this behavior by default, a specially crafted client could exploit this vulnerability to force the service termination (Red Hat Bugzilla).

The vulnerability can only be exploited by attackers who can connect to the nbdkit service. The attack surface is limited if nbdkit is not exposed over TCP, is bound only to a private network interface, or is protected by firewall rules. Additionally, if nbdkit is configured with TLS client authentication, only trusted clients can carry out this attack (Red Hat Bugzilla).

The vulnerability has been fixed in nbdkit versions 1.12.8, 1.14.2, and 1.15.2. Patches were released for different branches: 1.15 (development branch), 1.14, and 1.12, each addressing the assertion failure issue (Red Hat Bugzilla).