CVE-2025-14946: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-14946 is an argument injection vulnerability in libnbd, a C library for accessing Network Block Device (NBD) servers, that can lead to arbitrary code execution. The flaw was introduced with the addition of nbd+ssh:// URI support, which failed to sanitize the SSH server hostname. A malicious actor can exploit this by convincing libnbd to open a specially crafted URI containing a hostname beginning with -o, which is then interpreted as an SSH argument rather than a hostname. The vulnerability was reported on December 19, 2025, and affects libnbd versions prior to 1.24.1. It carries a CVSS v3.1 base score of 4.8 (Medium), assigned by Red Hat (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection). When libnbd processes an nbd+ssh:// URI, it passes the hostname component directly to the SSH subprocess without validation. A hostname beginning with -o is interpreted by the SSH client as a command-line option (e.g., -oProxyCommand=...), enabling an attacker to inject arbitrary SSH options and potentially trigger execution of arbitrary processes. Exploitation requires a local attacker with low privileges who can convince a user (user interaction required) to open a malicious URI, making the attack vector local with low complexity (Red Hat Bugzilla, libnbd Release Notes).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running libnbd. The impact spans confidentiality, integrity, and availability — all rated Low in the CVSS assessment — reflecting that the attacker's capabilities are constrained to the privilege level of the targeted user rather than full system compromise. Environments using libnbd to handle nbd+ssh:// URIs from untrusted sources (e.g., virtualization tooling, disk image management) are most at risk (Red Hat Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.022%, indicating a very low probability of exploitation in the near term. Detection coverage exists via Tenable Nessus plugin 279432 (Tenable).

1. Identify a target: Locate a system running a vulnerable version of libnbd (prior to 1.24.1) that processes nbd+ssh:// URIs, such as virtualization management tools or disk image utilities built on libnbd.
2. Craft a malicious URI: Construct an nbd+ssh:// URI where the hostname component begins with -o, for example: nbd+ssh://-oProxyCommand=<malicious_command>/export. The -o prefix causes the SSH client to interpret the value as an SSH option.
3. Inject an SSH option: Use SSH's ProxyCommand or similar options (e.g., -oProxyCommand=bash -c 'malicious_payload') to trigger execution of an arbitrary command when the SSH subprocess is spawned by libnbd.
4. Social engineering: Convince the target user to open the crafted URI through a vulnerable application (user interaction is required), for example by embedding it in a configuration file, a shared disk image reference, or a crafted application input.
5. Achieve code execution: The SSH subprocess executes the injected command with the privileges of the user running libnbd, enabling data exfiltration, persistence, or further lateral movement (Red Hat Bugzilla, libnbd Release Notes).

• Process: Unexpected child processes spawned by libnbd or its parent application (e.g., bash, curl, wget, python) with unusual arguments; SSH processes launched with -o flags containing ProxyCommand or other non-standard options.
• Logs: System or application logs showing SSH invocations with hostnames beginning with -o; audit logs (auditd) recording unexpected execve calls from libnbd-linked processes.
• Network: Unexpected outbound network connections originating from the user account running libnbd to unknown external hosts, potentially initiated via SSH ProxyCommand.
• File System: New or modified files in user-writable directories created by processes spawned from libnbd's SSH subprocess; unexpected cron jobs or shell scripts added under the affected user's home directory.

The vulnerability is fixed in libnbd version 1.24.1, which includes hostname sanitization for nbd+ssh:// URIs. Users should upgrade to libnbd 1.24.1 or later as the primary remediation. As a workaround, avoid processing nbd+ssh:// URIs from untrusted or user-controlled sources until the patch is applied. Red Hat has published a security advisory and the fix details are documented in the libnbd 1.24.1 release notes (libnbd Release Notes, Red Hat Advisory).