What this actually is.
Technical background, root cause, and affected surface.
Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error conditions occur simultaneously, which may allow a remote attacker to cause a minor service disruption via conditions that trigger incorrect error-handling paths.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- Low
- CVSS Score
- 3.7
- Status
- Published
- CWE
- CWE-682: Incorrect Calculation
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
Multiple source files: errno combinations using (err1 | err2) instead of storing or prioritizing errno values individually
Root cause: Programmer error: errno values are sequential integers, not bit flags; bitwise OR is semantically incorrect for combining them
When does this fire?
All conditions must be true for the exploit to succeed.
Error conditions that cause multiple errno-producing operations in sequence trigger the incorrect OR combination
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Incorrect error propagation; error handlers may silently ignore real errors or take incorrect recovery actions
C:N · I:N · A:L
CWE-682: Incorrect Calculation
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which replaces bitwise OR errno combinations with correct error prioritization logic.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.