What this actually is.
Technical background, root cause, and affected surface.
An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- High
- CVSS Score
- 7.5
- Status
- Published
- CWE
- CWE-191: Integer Underflow (Wrap or Wraparound)
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
libatalk/dsi/dsi_write.c: dsi_writeinit() - length calculation from DSI header fields without underflow protection
Root cause: Missing unsigned integer underflow check in DSI write length computation before use
When does this fire?
All conditions must be true for the exploit to succeed.
Unauthenticated attacker sends a crafted DSI write request with header fields that produce an integer underflow in the length calculation
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
AFP daemon crash causing complete denial of service to all connected AFP clients
C:N · I:N · A:H
CWE-191: Integer Underflow (Wrap or Wraparound)
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which adds length validation before the arithmetic operation in dsi_writeinit().
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.