CVE-2022-24809: net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference.
Other sources
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a GET-NEXT to the nsVacmAccessTable to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24809?
CVE-2022-24809 is classified as a medium severity vulnerability.
How do I fix CVE-2022-24809?
To mitigate CVE-2022-24809, upgrade the net-snmp package to version 5.9.2 or later.
What systems are affected by CVE-2022-24809?
CVE-2022-24809 affects net-snmp versions prior to 5.9.2, particularly on systems like Red Hat Enterprise Linux, Fedora, and Debian.
What type of attack does CVE-2022-24809 represent?
CVE-2022-24809 allows for a denial-of-service attack via a malformed OID in a GET-NEXT request.
Is there a workaround for CVE-2022-24809?
Temporary workarounds for CVE-2022-24809 include restricting access to the net-snmp service from untrusted networks.