Log in Start free

Vulnerability · Published May 14, 2025 · Assigned by GitHub_M

CVE-2025-46836net-tools Stack-based Buffer Overflow vulnerability

Medium 6.6

In plain English

A medium-severity improper input validation in net-tools from ecki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.2%top 89.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12net-tools2.10-0.1+deb12u1DSA-5923-1
Debian:12net-tools2.10-0.1+deb12u1DEBIAN-CVE-2025-46836
Debian:13net-tools2.10-1.2DEBIAN-CVE-2025-46836
Debian:14net-tools2.10-1.2DEBIAN-CVE-2025-46836
Ubuntu:22.04:LTSnet-tools1.60+git20181103.0eebece-1ubuntu5.1USN-7537-1
Ubuntu:22.04:LTSnet-tools1.60+git20181103.0eebece-1ubuntu5.4UBUNTU-CVE-2025-46836
Ubuntu:24.04:LTSnet-tools2.10-0.1ubuntu4.4UBUNTU-CVE-2025-46836
Ubuntu:24.04:LTSnet-tools2.10-0.1ubuntu4.1USN-7537-1
Ubuntu:25.10net-tools2.10-1.3ubuntu1UBUNTU-CVE-2025-46836

Affected products (as reported)

VendorProductVersions
ecki net-tools <= 2.10

Weakness: CWE-20, CWE-121 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

References