CVE-2026-44070

Executive Summary

CVE-2026-44070 describes a denial-of-service vulnerability in the Netatalk AFP server, affecting versions 2.0.0 through 4.4.2. The flaw resides in the charset conversion code, where an unbounded memory reallocation can be triggered by a remote authenticated attacker. By sending crafted character conversion requests, an attacker can cause the server to allocate excessive memory, leading to a minor denial of service. The vulnerability has a low CVSS score of 3.1 due to the requirement for authentication and the limited impact (only availability is affected). No public exploit code or proof-of-concept is currently available, and no official patch has been released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• Base Score: 3.1 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker must be authenticated to the AFP service.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – the service may become unresponsive or crash, but impact is limited.

Threat Level: Low. The requirement for authentication significantly reduces the attack surface. However, in environments where many users have AFP access, the risk is elevated.

Deep Dive & Mechanics

The vulnerability exists in the charset conversion routines within Netatalk’s AFP implementation. When a client requests a character set conversion (e.g., from UTF-8 to MacRoman), the server allocates memory to hold the converted data. The flaw is that the server does not properly bound the size of the output buffer. By sending a specially crafted conversion request that causes the conversion to produce an extremely large output (e.g., by exploiting expansion factors in certain character encodings), the server will repeatedly reallocate memory in an unbounded fashion. This can lead to memory exhaustion, causing the server to crash or become unresponsive.

The vulnerable code path is in the charset.c file, specifically in the function that handles AFPCharSet conversions. The function uses a loop that doubles the buffer size when the output exceeds the current capacity, but it lacks a maximum size check. An attacker can craft a request that causes the conversion to produce an output that grows exponentially, leading to an out-of-memory condition.

Vulnerable vs. Patched Code

Vulnerable Code (Netatalk 4.4.2):

// In charset.c
static char *convert_charset(const char *input, size_t input_len, const char *from, const char *to) {
    size_t output_size = input_len * 2; // initial guess
    char *output = malloc(output_size);
    if (!output) return NULL;

    iconv_t cd = iconv_open(to, from);
    if (cd == (iconv_t)-1) {
        free(output);
        return NULL;
    }

    char *inbuf = (char *)input;
    size_t inbytesleft = input_len;
    char *outbuf = output;
    size_t outbytesleft = output_size;

    while (inbytesleft > 0) {
        if (iconv(cd, &inbuf, &inbytesleft, &outbuf, &outbytesleft) == (size_t)-1) {
            if (errno == E2BIG) {
                // Double the buffer size
                size_t used = outbuf - output;
                output_size *= 2;
                char *new_output = realloc(output, output_size);
                if (!new_output) {
                    free(output);
                    iconv_close(cd);
                    return NULL;
                }
                output = new_output;
                outbuf = output + used;
                outbytesleft = output_size - used;
            } else {
                // Other error
                free(output);
                iconv_close(cd);
                return NULL;
            }
        }
    }
    iconv_close(cd);
    return output;
}

Patched Code (Hypothetical Fix):

// In charset.c
#define MAX_CONVERSION_SIZE (1024 * 1024 * 10) // 10 MB limit

static char *convert_charset(const char *input, size_t input_len, const char *from, const char *to) {
    size_t output_size = input_len * 2;
    if (output_size > MAX_CONVERSION_SIZE) {
        output_size = MAX_CONVERSION_SIZE;
    }
    char *output = malloc(output_size);
    if (!output) return NULL;

    iconv_t cd = iconv_open(to, from);
    if (cd == (iconv_t)-1) {
        free(output);
        return NULL;
    }

    char *inbuf = (char *)input;
    size_t inbytesleft = input_len;
    char *outbuf = output;
    size_t outbytesleft = output_size;

    while (inbytesleft > 0) {
        if (iconv(cd, &inbuf, &inbytesleft, &outbuf, &outbytesleft) == (size_t)-1) {
            if (errno == E2BIG) {
                size_t used = outbuf - output;
                output_size *= 2;
                if (output_size > MAX_CONVERSION_SIZE) {
                    // Exceeded maximum allowed size
                    free(output);
                    iconv_close(cd);
                    return NULL;
                }
                char *new_output = realloc(output, output_size);
                if (!new_output) {
                    free(output);
                    iconv_close(cd);
                    return NULL;
                }
                output = new_output;
                outbuf = output + used;
                outbytesleft = output_size - used;
            } else {
                free(output);
                iconv_close(cd);
                return NULL;
            }
        }
    }
    iconv_close(cd);
    return output;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Netatalk AFP server (version 2.0.0 to 4.4.2) running on a target network.
• Valid credentials for an AFP user account.

Exploitation Steps:

1. Identify AFP Server: Use Shodan or Nmap to find AFP servers on port 548.
2. Authenticate: Use a tool like afpfs-ng or a custom script to authenticate to the AFP server.
3. Craft Malicious Request: Send a character conversion request that triggers the unbounded memory allocation. For example, request a conversion from UTF-8 to UTF-16 with a specially crafted input that causes extreme expansion.
4. Trigger DoS: The server will allocate memory until it crashes or becomes unresponsive.

Example Script (Python using pyafp):

import socket
import struct

def send_malicious_conversion(host, port, username, password):
    # Simplified AFP connection and conversion request
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((host, port))
    # ... AFP authentication and session setup ...
    # Craft a conversion request that triggers unbounded allocation
    # This is a conceptual example; actual AFP protocol details are complex
    payload = b'\x00' * 1000  # Placeholder for crafted data
    sock.send(payload)
    sock.close()

# Usage
send_malicious_conversion('192.168.1.100', 548, 'user', 'pass')

Blue Team

Detection:

• Monitor memory usage on AFP servers. A sudden spike in memory consumption by the afpd process may indicate exploitation.
• Monitor for repeated AFP FPGetFileDirParms or FPOpenFork calls with unusual character set parameters.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

• Restrict AFP access to trusted users only.
• Implement network segmentation to limit exposure.
• Apply rate limiting on AFP connections.
• Monitor for unusual AFP traffic patterns.

Indicators of Compromise (IOCs)

• Network:
  • AFP traffic (port 548) with unusually large or malformed character conversion requests.
  • Repeated AFP FPGetFileDirParms or FPOpenFork commands with non-standard character set parameters.
• Host:
  • High memory usage by the afpd process.
  • Crash logs or core dumps from afpd.
  • System logs showing out-of-memory errors related to afpd.
• File:
  • Temporary files in /tmp or /var/tmp with large sizes created by afpd.

Detection Engineering

YARA Rule

rule CVE_2026_44070_Netatalk_DoS {
    meta:
        description = "Detects Netatalk charset conversion DoS attempt"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-44070"
    strings:
        $afp_header = { 00 00 00 00 00 00 00 00 } // AFP header placeholder
        $charset_cmd = { 01 02 } // Example AFP command for charset conversion
    condition:
        $afp_header at 0 and $charset_cmd
}

Sigma Rule

title: Netatalk Charset Conversion DoS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-44070 by sending crafted charset conversion requests to Netatalk AFP servers.
author: Valters IT
date: 2025/04/10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 548
        app_protocol: afp
        event_type: alert
        alert.signature_id: 202644070
    condition: selection
falsepositives:
    - Legitimate AFP traffic with unusual character sets
level: medium

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 548 (msg:"CVE-2026-44070 Netatalk Charset Conversion DoS Attempt"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"|01 02|"; within:10; reference:cve,2026-44070; classtype:attempted-dos; sid:202644070; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit AFP access to only trusted users and networks.
2. Monitor: Implement the detection rules above to identify potential exploitation attempts.
3. Rate Limiting: Configure rate limiting on AFP connections to reduce the impact of repeated requests.

Long-Term Fix:

• Patch: Await an official patch from the Netatalk project. The fix should implement a maximum buffer size limit in the charset conversion code, as shown in the patched code example.
• Upgrade: Once a patched version is released, upgrade to the latest version.
• Workaround: If patching is not possible, consider disabling charset conversion features or using a firewall to restrict AFP access.

Valters IT Signature: This report was generated by Valters IT DevSecOps & CTI Expert System. For questions, contact support@valtersit.com.