CVE-2022-43634

Deeper analysis

CVE-2022-43634 is a heap-based buffer overflow in Netatalk that affects the dsi_writeinit function. The flaw stems from missing validation on the length of attacker-supplied data before it is copied into a fixed-size buffer on the heap. Successful exploitation grants remote code execution with root privileges and requires no authentication. The vulnerability carries a CVSS 3.1 base score of 9.8 and is tracked as CWE-122; it was originally reported as ZDI-CAN-17646.

Unauthenticated remote attackers can send a crafted DSI request to a vulnerable Netatalk server and achieve arbitrary code execution in the root context. Because the service typically listens on the network and runs with elevated privileges, compromise of the host follows directly from successful exploitation.

Public advisories and package updates from Debian LTS and Fedora document the availability of patched Netatalk builds that correct the length check in dsi_writeinit. A corresponding upstream pull request supplies the source-level fix for distributions that build from the Netatalk repository.

EPSS for the CVE rose from a low baseline to a peak of 0.1878 in January 2025 before receding to the current value of 0.0399, indicating measurable post-disclosure exploitation interest.