CVE-2022-0194
Published: 28 March 2023
Summary
CVE-2022-0194 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Debian Debian Linux. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-0194 is a stack-based buffer overflow in Netatalk that permits unauthenticated remote code execution. The flaw resides in the ad_addcomment function, which fails to validate the length of attacker-supplied data before copying it into a fixed-length buffer on the stack, and carries a CVSS 3.1 score of 9.8. It was originally reported as ZDI-CAN-15876 and affects Netatalk installations prior to the fixes referenced in the vendor and distribution advisories.
An unauthenticated attacker with network access can send a crafted request that triggers the overflow, allowing arbitrary code to run with root privileges on the affected system. No user interaction or credentials are required, and the attack can be mounted directly over the network.
Debian, Gentoo, and upstream Netatalk advisories direct administrators to apply the patches released in Netatalk 3.1.13 or later, or to install the corresponding updates provided in DSA-5503 and related distribution packages. The references also include the Zero Day Initiative advisory ZDI-22-530 that first documented the issue.
EPSS for the vulnerability rose from a low baseline to a peak of 0.4141 on 2025-01-22 before receding to the current value of 0.0911, indicating that meaningful exploitation interest developed well after the March 2023 disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15398
Vulnerability details
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ad_addcomment function. The issue results from the lack of proper validation of…
more
the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15876.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.