PT-2025-21250 · Net Tools+5 · Net Tools+5
Published
2025-05-14
·
Updated
2026-03-26
·
CVE-2025-46836
CVSS v3.1
6.6
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H |
Name of the Vulnerable Software and Affected Versions:
net-tools versions up to and including 2.10
Description:
The issue is related to the Linux network utilities in the net-tools package, which do not properly validate the structure of /proc files when showing interfaces. This can lead to possible arbitrary code execution or crash due to a buffer overflow in the
get name() function in interface.c. The function copies interface labels from /proc/net/dev into a fixed 16-byte stack buffer without bounds checking. The known attack path does not require privilege but also does not provide privilege escalation.Recommendations:
For versions up to and including 2.10, update to version 2.20 or later, which is expected to include a patch for this issue.
As a temporary workaround, consider restricting access to the
/proc/net/dev file to minimize the risk of exploitation.Exploit
Fix
LPE
RCE
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Suse
Ubuntu
Net Tools