CVE-2022-23125
Published: 28 March 2023
Summary
CVE-2022-23125 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Debian Debian Linux. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-23125 is a remote code execution vulnerability in Netatalk, an open-source implementation of the Apple Filing Protocol. The flaw resides in the copyapplfile function, which fails to validate the length of user-supplied data when parsing the len element before copying it into a fixed-length stack-based buffer, resulting in a classic stack-based buffer overflow (CWE-121 and CWE-787).
Unauthenticated remote attackers can send a specially crafted request over the network to trigger the overflow and execute arbitrary code with root privileges on affected installations. No user interaction or authentication is required, and the vulnerability carries a CVSS 3.1 score of 9.8.
Public advisories and patches recommend upgrading to Netatalk 3.1.13 or later, with distribution-specific fixes available in Debian DSA-5503, Debian LTS, and Gentoo GLSA-202311-02. The original Zero Day Initiative advisory ZDI-22-526 provides additional technical detail on the issue.
EPSS for this CVE rose from a low baseline to a peak of 0.4632 (current value 0.3213), indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28216
Vulnerability details
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the copyapplfile function. When parsing the len element, the process does not properly…
more
validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15869.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.