Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-42464 is a critical-severity Type Confusion (CWE-843) vulnerability in Debian Debian Linux. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 19% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A Type Confusion vulnerability exists in the Spotlight RPC functions within afpd of Netatalk 3.1.x versions prior to 3.1.17. The flaw occurs during parsing of Spotlight RPC packets that use key-value dictionaries, where callers of the dalloc_value_for_key() function perform no type checking on returned objects. This allows an attacker to manipulate pointer values, and the issue is assigned CWE-843 with a CVSS 3.1 score of 9.8.
An unauthenticated remote attacker can send specially crafted Spotlight RPC packets to an affected Netatalk server. Successful exploitation grants the ability to control memory pointers and theoretically achieve remote code execution on the host, with no user interaction or privileges required.
Public advisories, including the Netatalk security notice and the Debian LTS announcement, direct users to upgrade to Netatalk 3.1.17 or later to address the type-checking deficiency. The Netatalk project page and associated issue tracker provide the corresponding patch details.
The EPSS score remains low, with a current value of 0.0652 and a peak of 0.0770.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-46904
Vulnerability Data
A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the…
more
values can be any of the supported types in the underlying protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a malicious actor may be able to fully control the value of the pointer and theoretically achieve Remote Code Execution on the host. This issue is similar to CVE-2023-34967.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.2V15.3.5
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent type-confusion flaws via safe typing, static analysis, and code review while the control itself addresses many additional weaknesses.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.