Executive brief
Netatalk is a file server that enables Unix-like systems to share files with Apple devices over a network. A stack-based buffer overflow vulnerability in its afpd daemon allows authenticated attackers to crash the service or potentially execute malicious code by manipulating file operations that cross file system boundaries within shared volumes.
Technical details
The vulnerability is a stack buffer overflow caused by integer underflow in the copydir() function of Netatalk's afpd daemon. When calculating remaining buffer space for path construction, the code subtracts an already-incremented length from the current string length, causing srem and drem variables to underflow to SIZE_MAX. This defeats boundary checks against filename length, allowing strcpy() calls to overflow nearly full stack buffers. The vulnerability is triggered when file operations cross device boundaries within AFP shared volumes. Exploitation requires authentication and network access; the attack yields potential remote code execution via stack return address overwriting, or at minimum a reliable denial of service. Version 4.4.3 patches the vulnerability by using sizeof() instead of strlen() for remaining buffer calculations.
Affected products
- Netatalk Netatalk 3.1.19 through 4.4.2
Timeline
- 2026-05-28: disclosed
- 2026-05-13: patched: Version 4.4.3 released