CVE-2017-10664

What it actually does

The flaw prevents qemu-nbd from ignoring SIGPIPE signals, so an abrupt client disconnect during an outgoing reply causes the daemon process to terminate with a crash.

Why it matters to the business

Services that expose virtual disk images over the network can be taken offline by a single unauthenticated connection, producing unplanned downtime and requiring manual restart until the package is updated.

How an attack unfolds

An attacker opens a TCP connection to the qemu-nbd listener, waits for the server to begin sending a reply, then immediately closes the socket; the resulting SIGPIPE is not handled and the daemon aborts.

How to fix it

Upgrade gosu (Chainguard) to 1.17-r3 or later and gosu (Wolfi) to 1.17-r3 or later; restart any running qemu-nbd instances after the package update.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed release, then verify that SIGPIPE signals no longer terminate the daemon under simulated disconnect conditions.

Typical attack path

1. Locate an exposed qemu-nbd port
2. Establish a TCP connection and issue a read request
3. Abruptly terminate the connection before the reply completes
4. Observe the daemon process exit and restart loop

How to detect it

Review system and application logs for unexpected qemu-nbd process terminations, repeated restarts, or SIGPIPE-related signals around the time of service outages.

What your security team should do

• Apply the 1.17-r3 package update on all affected systems within the next maintenance window
• Scan container images and base layers for the vulnerable gosu versions
• Add qemu-nbd crash and restart events to alerting rules