CVE-2022-24807: 
NixOS vulnerability analysis and mitigation

CVE-2022-24807 affects net-snmp prior to version 5.9.2. A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. This vulnerability requires read-write credentials to exploit (NVD, Debian Security).

The vulnerability is caused by improper bounds checking in the handling of OIDs (Object Identifiers) in SET requests specifically targeting the vacmAccessTable in the SNMP-VIEW-BASED-ACM-MIB. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (NVD).

The vulnerability can be exploited by an authenticated user with read-write credentials to cause out-of-bounds memory access, which could potentially lead to denial of service or other security implications (Red Hat).

This vulnerability requires an attacker to have read-write credentials to the SNMP service. The attack can be performed remotely by sending specially crafted SET requests to the affected SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable (NVD).

Users should upgrade to net-snmp version 5.9.2 or later which contains the fix. Additionally, it is recommended to use strong SNMPv3 credentials and avoid sharing them. For those who must use SNMPv1 or SNMPv2c, it is advised to use a complex community string and enhance protection by restricting access to specific IP address ranges (GitHub).