Log in Start free

Vulnerability · Published Apr 16, 2024 · Assigned by GitHub_M

CVE-2022-24810net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.

Medium 6.5

In plain English

A medium-severity null pointer dereference in net-snmp from net-snmp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.2%top 32.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a SET to the nsVacmAccessTable to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9net-snmp1:5.9.1-13.el9_4.3ALSA-2024:7260
AlmaLinux:9net-snmp-agent-libs1:5.9.1-13.el9_4.3ALSA-2024:7260
AlmaLinux:9net-snmp-devel1:5.9.1-13.el9_4.3ALSA-2024:7260
AlmaLinux:9net-snmp-libs1:5.9.1-13.el9_4.3ALSA-2024:7260
AlmaLinux:9net-snmp-perl1:5.9.1-13.el9_4.3ALSA-2024:7260
AlmaLinux:9net-snmp-utils1:5.9.1-13.el9_4.3ALSA-2024:7260
AlmaLinux:9python3-net-snmp1:5.9.1-13.el9_4.3ALSA-2024:7260
Alpine:v3.20net-snmp5.9.3-r0ALPINE-CVE-2022-24810
Alpine:v3.21net-snmp5.9.3-r0ALPINE-CVE-2022-24810
Alpine:v3.22net-snmp5.9.3-r0ALPINE-CVE-2022-24810
Alpine:v3.23net-snmp5.9.3-r0ALPINE-CVE-2022-24810
Alpine:v3.24net-snmp5.9.3-r0ALPINE-CVE-2022-24810
Debian:12net-snmp5.9.3+dfsg-1DEBIAN-CVE-2022-24810
Debian:13net-snmp5.9.3+dfsg-1DEBIAN-CVE-2022-24810
Debian:14net-snmp5.9.3+dfsg-1DEBIAN-CVE-2022-24810
Rocky Linux:9net-snmp1:5.9.1-13.el9_4.3RLSA-2024:7260
Ubuntu:22.04:LTSnet-snmp5.9.1+dfsg-1ubuntu2.2UBUNTU-CVE-2022-24810
Ubuntu:22.04:LTSnet-snmp5.9.1+dfsg-1ubuntu2.2USN-5543-1

Affected products (as reported)

VendorProductVersions
net-snmp net-snmp 0 – before 5.9.2

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References