What this actually is.
Technical background, root cause, and affected surface.
An integer underflow in the volxlate function in Netatalk 3.0.0 through 4.4.2 allows a local privileged user to obtain limited information, modify limited data, or cause a minor service disruption via crafted volume translation input.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- Low
- CVSS Score
- 3.9
- Status
- Published
- CWE
- CWE-191: Integer Underflow (Wrap or Wraparound)
- Vector
- CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
afpd/volume.c: volxlate() - size arithmetic without unsigned underflow protection
Root cause: Missing underflow check on unsigned arithmetic in volxlate() before use of result
When does this fire?
All conditions must be true for the exploit to succeed.
Local administrator-level user triggers volume translation with crafted size parameters that cause arithmetic underflow
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Limited out-of-bounds memory access; minor data disclosure or modification
C:L · I:L · A:L
CWE-191: Integer Underflow (Wrap or Wraparound)
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which adds underflow guards in volxlate().
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.