Skip to content
Fencer Vulns
high 7.5

CVE-2024-38440 json

Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly…

published 2024-06-16 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-37332

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in BN_bin2bn in etc/uams/uams_dhx_pam.c. The original issue 1097 report stated: 'The latest version of Netatalk (v3.2.0) contains a security vulnerability. This vulnerability arises due to a lack of validation for the length field after parsing user-provided data, leading to an out-of-bounds heap write of one byte (\0). Under specific configurations, this can result in reading metadata of the next heap block, potentially causing a Denial of Service (DoS) under certain heap layouts or with ASAN enabled. ... The vulnerability is located in the FPLoginExt operation of Netatalk, in the BN_bin2bn function found in /etc/uams/uams_dhx_pam.c ... if (!(bn = BN_bin2bn((unsigned char *)ibuf, KEYSIZE, NULL))) ... threads ... [#0] Id 1, Name: "afpd", stopped 0x7ffff4304e58 in ?? (), reason: SIGSEGV ... [#0] 0x7ffff4304e58 mov BYTE PTR [r14+0x8], 0x0 ... mov rdx, QWORD PTR [rsp+0x18] ... afp_login_ext(obj=<optimized out>, ibuf=0x62d000010424 "", ibuflen=0xffffffffffff0015, rbuf=<optimized out>, rbuflen=<optimized out>) ... afp_over_dsi(obj=0x5555556154c0 <obj>).' 2.4.1 and 3.1.19 are also fixed versions.

Patch / fix

  • netatalk netatalk 3.2.1
  • netatalk Debian 14, Debian 13 3.1.18~ds-2

debian advisories DEBIAN-CVE-2024-38440

  • netatalk Ubuntu 20.04 LTS 3.1.12~ds-4ubuntu0.20.04.4
  • netatalk Ubuntu 22.04 LTS 3.1.12~ds-9ubuntu0.22.04.4
  • netatalk Ubuntu Pro 14.04 LTS 2.2.2-1ubuntu2.2+esm2
  • netatalk Ubuntu Pro 16.04 LTS 2.2.5-1ubuntu0.2+esm2
  • netatalk Ubuntu Pro 18.04 LTS 2.2.6-1ubuntu0.18.04.2+esm2
  • netatalk Ubuntu Pro 24.04 LTS 3.1.18~ds-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2024-38440

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • netatalk SLE Workstation Extension 12 SP5, SLE Software Development Kit 12 SP5 3.1.18-3.25.1

suse advisories SUSE-SU-2024:2301-1

  • netatalk Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 3.1.19-r0

alpine advisories ALPINE-CVE-2024-38440

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-38440 updated

netatalk: multiple vulnerabilities

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/Netatalk/netatalk/security/advisories/GHSA-mxx4-9fhm-r3w5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • netatalk netatalk

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.