CVE-2022-24808: net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES
CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
Other sources
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24808?
The severity of CVE-2022-24808 is classified as a high-severity vulnerability.
How do I fix CVE-2022-24808?
To fix CVE-2022-24808, update to net-snmp version 5.9.2 or later.
What impact does CVE-2022-24808 have?
CVE-2022-24808 can lead to a denial of service due to a malformed OID in a SET request.
Which software is affected by CVE-2022-24808?
CVE-2022-24808 affects versions of net-snmp prior to 5.9.2.
Is there a workaround for CVE-2022-24808 if I can't update?
Disabling the NET-SNMP-AGENT-MIB or limiting access to the SNMP agent can mitigate risks until a patch is applied.