Heap-based buffer overflow vulnerability in Netatalk 3.2.0 due to incorrect use of FPLoginExt

CVE-2024-38440

What is CVE-2024-38440?

The vulnerability in Netatalk arises from an off-by-one error leading to a heap-based buffer overflow. This flaw is triggered by improper validation of user-provided data, specifically during the FPLoginExt operation in the BN_bin2bn function located in the file /etc/uams/uams_dhx_pam.c. When certain configurations are in place, the exploitation of this issue may allow reading of adjacent memory, causing a Denial of Service (DoS) under specific heap layouts, particularly when AddressSanitizer (ASAN) is enabled.

References