PT-2022-7452 · Net Snmp+9 · Net-Snmp+9

Menglong2234 · Published 2022-11-06 · Updated 2025-11-25 · CVE-2022-44793

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Net-SNMP versions 5.4.3 through 5.9.3

Description The issue is related to a NULL Pointer Exception bug in the handle ipv6IpForwarding() function. This bug can be exploited by a remote attacker using a specially crafted UDP packet, resulting in a Denial of Service. The exploitation allows the attacker to cause the instance to crash.

Recommendations For Net-SNMP versions 5.4.3 through 5.9.3, consider disabling the handle ipv6IpForwarding() function as a temporary workaround until a patch is available. Restrict access to the agent/mibgroup/ip-mib/ip scalars.c module to minimize the risk of exploitation. Avoid using the vulnerable function in the affected Net-SNMP versions until the issue is resolved.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2023:2444

ALSA-2023:2969

AZL-11386

AZL-41810

BDU:2024-06511

CESA-2023_2969

CVE-2022-44793

DLA-3270-1

DLA-4381-1

MGASA-2023-0015

OESA-2023-1010

OPENSUSE-SU-2023_0075-1

OPENSUSE-SU-2024:12598-1

RHSA-2023:2444

RHSA-2023:2969

RHSA-2023_2444

RHSA-2023_2969

ROSA-SA-2024-2473

SUSE-SU-2023:0068-1

SUSE-SU-2023:0075-1

USN-5795-1

USN-5795-2

Affected Products

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Net-Snmp

Red Hat

Red Os

Suse

Ubuntu

References · 66

• 🔥 https://github.com/net-snmp/net-snmp/issues/475 · Exploit
• 🔥 https://gist.github.com/menglong2234/d07a65b5028145c9f4e1d1db8c4c202f · Exploit
• https://ubuntu.com/security/CVE-2022-24805 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0068-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5795-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24806 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5795-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-2444.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0015.html · Security Note
• https://osv.dev/vulnerability/DLA-3270-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24810 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-44792 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-44793 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-44793 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:2444 · Vendor Advisory