CVE-2022-23122
Published: 28 March 2023
Summary
CVE-2022-23122 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Debian Debian Linux. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-23122 is a remote code execution vulnerability in Netatalk, an open-source implementation of Apple Filing Protocol (AFP) for file sharing. The flaw resides in the setfilparams function, which fails to validate the length of user-supplied data before copying it into a fixed-length stack-based buffer, resulting in a classic stack-based buffer overflow (CWE-121 and CWE-787). The issue affects multiple Netatalk installations prior to the 3.1.13 release and carries a CVSS 3.1 score of 9.8.
Unauthenticated remote attackers can exploit the vulnerability over the network by sending a crafted request that triggers the overflow. Successful exploitation grants the attacker the ability to execute arbitrary code with root privileges on the affected system.
Vendor and distribution advisories, including the Netatalk 3.1.13 release notes, Debian DSA-5503, Debian LTS announcement, and Gentoo GLSA-202311-02, direct users to upgrade to the patched version that corrects the buffer handling in setfilparams. The original Zero Day Initiative advisory (ZDI-22-529) also references the same remediation path.
EPSS scores for the CVE rose sharply from a low baseline to a peak of 0.4141 on 2025-01-22 before receding to the current value of 0.0757, indicating that meaningful exploitation interest developed well after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28213
Vulnerability details
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setfilparams function. The issue results from the lack of proper validation of…
more
the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15837.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.