PT-2022-7451 · Net Snmp+9 · Net-Snmp+9

Menglong2234 · Published 2022-11-06 · Updated 2025-11-25 · CVE-2022-44792

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Net-SNMP versions 5.8 through 5.9.3

Description The issue is related to a NULL Pointer Exception bug in the handle ipDefaultTTL() function. This bug can be exploited by a remote attacker with write access to cause the instance to crash via a specially crafted UDP packet, resulting in a Denial of Service.

Recommendations For Net-SNMP versions 5.8 through 5.9.3, consider disabling the handle ipDefaultTTL() function as a temporary workaround until a patch is available. Restrict access to the UDP protocol to minimize the risk of exploitation. Avoid using the handle ipDefaultTTL() function in the affected API endpoint until the issue is resolved.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2023:2444

ALSA-2023:2969

AZL-11385

AZL-41665

BDU:2024-06510

CESA-2023_2969

CVE-2022-44792

DLA-3270-1

DLA-4381-1

MGASA-2023-0015

OESA-2023-1010

OPENSUSE-SU-2023_0075-1

RHSA-2023:2444

RHSA-2023:2969

RHSA-2023_2444

RHSA-2023_2969

ROSA-SA-2024-2473

SUSE-SU-2023:0068-1

SUSE-SU-2023:0075-1

SUSE-SU-2023_0068-1

SUSE-SU-2023_0075-1

USN-5795-1

USN-5795-2

Affected Products

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Net-Snmp

Red Hat

Red Os

Suse

Ubuntu

References · 66

• 🔥 https://github.com/net-snmp/net-snmp/issues/474 · Exploit
• 🔥 https://gist.github.com/menglong2234/b7bc13ae1a144f47cc3c95a7ea062428 · Exploit
• https://ubuntu.com/security/CVE-2022-24805 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-44792 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:0068-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5795-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-44792 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24806 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5795-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-2444.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0015.html · Security Note
• https://osv.dev/vulnerability/DLA-3270-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24810 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-44792 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-24805 · Vendor Advisory