Input validation error in net-tools - CVE-2025-46836

Vulnerability identifier: #VU116115

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-46836

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to certain network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash.

net-tools
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
Debian Linux
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Legacy Module
Basesystem Module
openSUSE Leap
Ubuntu
Anolis OS
net-tools (Ubuntu package)
net-tools-debuginfo
net-tools-debugsource
net-tools
net-tools-deprecated
net-tools-deprecated-debuginfo
net-tools-lang
net-tools (Debian package)
net-tools-doc

Install updates from vendor's website.

net-tools (Ubuntu package) - addressed in versions 1.60+git20180626.aebd88e-1ubuntu1.1, 1.60+git20181103.0eebece-1ubuntu5.1, 2.10-0.1ubuntu4.1, 2.10-1.1ubuntu1.24.10.1, 2.10-1.1ubuntu1.25.04.1
net-tools-debuginfo - addressed in versions 1.60-765.12.1, 1.60-765.15.1, 2.0+git20170221.479bb4a-150000.5.13.1
net-tools-debugsource - addressed in versions 1.60-765.12.1, 1.60-765.15.1, 2.0+git20170221.479bb4a-150000.5.13.1
net-tools - addressed in versions 1.60-765.12.1, 1.60-765.15.1, 2.0+git20170221.479bb4a-150000.5.13.1
net-tools-deprecated - update to 2.0+git20170221.479bb4a-150000.5.13.1
net-tools-deprecated-debuginfo - update to 2.0+git20170221.479bb4a-150000.5.13.1
net-tools-lang - update to 2.0+git20170221.479bb4a-150000.5.13.1
net-tools (Debian package) - update to 2.10-0.1+deb12u1
net-tools - addressed in versions 2.10-4, 2.10-5
net-tools-doc - addressed in versions 2.10-4, 2.10-5

• https://github.com/ecki/net-tools/commit/7a8f42fb20013a1493d8cae1c43436f85e656f2d
• https://github.com/ecki/net-tools/security/advisories/GHSA-pfwf-h6m3-63wf

• Improper input validation in net-tools
• Debian update for net-tools
• SUSE update for net-tools
• SUSE update for net-tools
• SUSE update for net-tools
• Anolis OS update for net-tools
• Ubuntu update for net-tools
• Anolis OS update for net-tools