CVE-2022-43634 Memory corruption in Netatalk

Critical 9.8 Published 29 Mar 2023 Updated 12 Feb 2025

Remote attackers can execute arbitrary code as root on Netatalk servers via a heap buffer overflow in the dsi_writeinit function without authentication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-43634?

CVE-2022-43634 is a critical memory corruption vulnerability in Netatalk, published on 29 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dsi_writeinit function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17646.

Weakness: CWE-122

Which versions are affected by CVE-2022-43634?

It affects 1 product.

Linux distribution packages (2)

`netatalk` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`3.1.0-3.14.1`
`netatalk` SUSE:Linux Enterprise Workstation Extension 12 SP5	All versions	`3.1.0-3.14.1`

Products include Netatalk Netatalk.

How do I fix CVE-2022-43634?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-43634 being exploited?

There is no known exploitation of CVE-2022-43634 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2022-43634, GHSA-fwj9-7qq8-jc93, SUSE-SU-2023:0316-1, UBUNTU-CVE-2022-43634.