CVE-2024-38440: Netatalk Buffer Overflow Vulnerability

CVE-2024-38440 Overview

Netatalk versions before 3.2.1 contain an off-by-one error in the BN_bin2bn function within etc/uams/uams_dhx_pam.c. The flaw resides in the FPLoginExt authentication operation and stems from missing validation of the length field after parsing user-supplied data. Exploitation triggers a one-byte heap out-of-bounds write (\0), producing a heap-based buffer overflow and segmentation fault in the afpd daemon. A remote, unauthenticated attacker can reach the vulnerable code path over the network and crash the service, causing a Denial of Service (DoS). The issue is classified as [CWE-193] Off-by-One Error and is fixed in Netatalk 2.4.1, 3.1.19, and 3.2.1.

Critical Impact
An unauthenticated remote attacker can crash the afpd Apple Filing Protocol daemon, disrupting file sharing services for all connected clients.

Affected Products

Netatalk 3.2.0
Netatalk versions before 3.1.19 (3.1.x branch)
Netatalk versions before 2.4.1 (2.x branch)

Discovery Timeline

2024-06-16 - CVE-2024-38440 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-38440

Vulnerability Analysis

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) used to provide file services to macOS clients from Unix-like systems. The vulnerability lives in the DHX PAM User Authentication Module (uams_dhx_pam.c), which handles authenticated logins via the FPLoginExt AFP operation. When parsing client-supplied data, the code calls BN_bin2bn((unsigned char *)ibuf, KEYSIZE, NULL) without validating that the input buffer actually contains KEYSIZE bytes. The OpenSSL BN_bin2bn routine writes a trailing null byte at an offset derived from the asserted length, producing a one-byte heap write past the allocation boundary.

Debug traces from issue #1097 show the crash inside afp_login_ext, where ibuflen is corrupted to 0xffffffffffff0015 and the faulting instruction mov BYTE PTR [r14+0x8], 0x0 triggers SIGSEGV. Under specific heap layouts, the stray write corrupts adjacent chunk metadata, terminating the daemon.

Root Cause

The root cause is an off-by-one boundary error [CWE-193]. The DHX PAM authentication handler trusts the length field embedded in the client request rather than validating it against the actual received buffer length before invoking BN_bin2bn. This mismatch enables the OpenSSL bignum conversion to read beyond the source buffer and write a sentinel byte outside the destination heap allocation.

Attack Vector

Exploitation requires network access to a Netatalk afpd instance configured to use the DHX PAM authentication method, which is a common default. The attacker initiates an AFP session and issues a malformed FPLoginExt request with a length field that disagrees with the actual payload size. No authentication or user interaction is required. The result is a crash of the afpd process and termination of all active AFP sessions.

No public proof-of-concept exploit is referenced in the advisory. Technical details are documented in GitHub Issue #1097 and the GitHub Security Advisory GHSA-mxx4-9fhm-r3w5.

Detection Methods for CVE-2024-38440

Indicators of Compromise

Unexpected SIGSEGV crashes of the afpd process, with core dumps showing the faulting instruction inside afp_login_ext or BN_bin2bn.
Abnormally large or negative ibuflen values logged during AFP login handling.
Repeated AFP client disconnections coinciding with restarts of the Netatalk service.
Inbound TCP connections to port 548 from unexpected sources immediately preceding daemon crashes.

Detection Strategies

Monitor system journals (journalctl -u netatalk, /var/log/syslog) for afpd segmentation faults and systemd service restart loops.
Inspect generated core dumps for stack frames containing BN_bin2bn, afp_login_ext, or afp_over_dsi as confirmation of exploit attempts.
Deploy network signatures on TCP port 548 (AFP) that flag FPLoginExt requests with malformed length fields.
Correlate authentication failure spikes with afpd process termination events in centralized logging.

Monitoring Recommendations

Track the installed Netatalk package version across Linux and BSD hosts and alert when versions predate 2.4.1, 3.1.19, or 3.2.1.
Forward afpd crash telemetry and AFP access logs to a central log platform for correlation with network-based scanning activity.
Enable systemd watchdog or process supervision alerts to surface repeated daemon restarts that may indicate exploitation.

How to Mitigate CVE-2024-38440

Immediate Actions Required

Upgrade Netatalk to version 3.2.1, 3.1.19, or 2.4.1 (or later) on all affected systems.
For Debian-based systems, apply updates published in the Debian LTS Security Announcement.
Restrict network exposure of TCP port 548 to trusted management networks until patching is complete.
Audit afp.conf to confirm which User Authentication Modules (UAMs) are enabled and disable uams_dhx_pam.so if not required.

Patch Information

The upstream fix is published in the Netatalk Security Advisory for CVE-2024-38440 and tracked in GitHub Security Advisory GHSA-mxx4-9fhm-r3w5. The patched releases add explicit validation of the ibuf length before invoking BN_bin2bn, ensuring the asserted size does not exceed the received data. Fixed versions are Netatalk 2.4.1, 3.1.19, and 3.2.1.

Workarounds

Block or firewall TCP port 548 from untrusted networks if AFP services are not required externally.
Disable the DHX PAM authentication module in afp.conf by removing uams_dhx_pam.so from the uam list directive and restarting afpd.
Where AFP is not in use, stop and disable the Netatalk service entirely until patches can be applied.

bash

# Example afp.conf hardening: restrict UAMs and bind to a management interface
[Global]
  uam list = uams_clrtxt.so uams_guest.so
  afp listen = 10.0.0.5
  afp port = 548

# Verify installed Netatalk version against fixed releases
dpkg -l | grep netatalk    # Debian / Ubuntu
rpm -q netatalk            # RHEL / Fedora

# Restart the service after configuration changes
systemctl restart netatalk