CVE-2022-24808: net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES
CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
Other sources
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/net-snmpto a version that resolves this vulnerability.Fixed in 5.9.2 - Upgrade
Upgrade
debian/net-snmpto a version that resolves this vulnerability.Fixed in 5.9.3+dfsg-2+deb12u1Fixed in 5.9.4+dfsg-2+deb13u1Fixed in 5.9.5.2+dfsg-3 - Upgrade
Upgrade
alpine/net-snmpto a version that resolves this vulnerability.Fixed in 5.9.3-r0 - Upgrade
Upgrade
debian/net-snmpto a version that resolves this vulnerability.Fixed in 5.9.3+dfsg-1 - Upgrade
Upgrade
net-snmpto a version that resolves this vulnerability.Fixed in 5.9.2 - Configuration
Use a complex community string when SNMPv1 or SNMPv2c must be used.
SNMPv1/SNMPv2c community string = complex - Compensating control
Restrict SNMPv1/SNMPv2c access to a given IP address range.
- Compensating control
Use strong SNMPv3 credentials and avoid sharing the credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24808?
The severity of CVE-2022-24808 is classified as a high-severity vulnerability.
How do I fix CVE-2022-24808?
To fix CVE-2022-24808, update to net-snmp version 5.9.2 or later.
What impact does CVE-2022-24808 have?
CVE-2022-24808 can lead to a denial of service due to a malformed OID in a SET request.
Which software is affected by CVE-2022-24808?
CVE-2022-24808 affects versions of net-snmp prior to 5.9.2.
Is there a workaround for CVE-2022-24808 if I can't update?
Disabling the NET-SNMP-AGENT-MIB or limiting access to the SNMP agent can mitigate risks until a patch is applied.