CVE-2025-46836

net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. get_name() in interface.c copies interface labels from /proc/net/dev into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.

net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. get_name() in interface.c copies interface labels from /proc/net/dev into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.

net-tools Stack-based Buffer Overflow vulnerability. (CVE-2025-46836)

These are all security issues fixed in the net-tools-2.10-4.1 package on the GA media of openSUSE Tumbleweed.

This update for net-tools fixes the following issues:

• Fix stack buffer overflow in parse_hex (bsc#1248687, GHSA-h667-qrp8-gj58).
• Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687, GHSA-w7jq-cmw2-cq59).
• Avoid unsafe memcpy in ifconfig (bsc#1248687).
• Prevent overflow in ax25 and netrom (bsc#1248687)
• Keep possibility to enter long interface names, even if they are not accepted by the kernel, because it was always possible up to CVE-2025-46836 fix. But issue a warning about an interface name concatenation (bsc#1248410).

This update for net-tools fixes the following issues:

• CVE-2025-46836: Fixed absence of bound check that might lead to a stack buffer overflow (bsc#1243581)

This update for net-tools fixes the following issues:

Security issues fixed:

• Avoid unsafe use of memcpy in ifconfig (bsc#1248687).
• Prevent overflow in ax25 and netrom (bsc#1248687).
• Fix stack buffer overflow in parse_hex (bsc#1248687).
• Fix stack buffer overflow in proc_gen_fmt (bsc#1248687).

Other issues fixed:

• Allow use of long interface names after CVE-2025-46836 fix, even if they are not accepted by the kernel (bsc#1248410).

This update for net-tools fixes the following issues:

Security issues fixed:

• CVE-2025-46836: missing bounds check in get_name may lead to a stack buffer overflow (bsc#1243581).
• Avoid unsafe use of memcpy in ifconfig (bsc#1248687).
• Prevent overflow in ax25 and netrom (bsc#1248687).
• Fix stack buffer overflow in parse_hex (bsc#1248687).
• Fix stack buffer overflow in proc_gen_fmt (bsc#1248687).

Other issues fixed:

• Allow use of long interface names after CVE-2025-46836 fix, even if they are not accepted by the kernel (bsc#1248410).
• Fix netrom support.

This update for net-tools fixes the following issues:

• Provide more readable error for interface name size checking (bsc#1243581)

• Perform bound checks when parsing interface labels in /proc/net/dev (bsc#1243581, bsc#1246608. CVE-2025-46836)

This update for net-tools fixes the following issues:

• Fixed stack buffer overflow in parse_hex, proc_gen_fmt, ax25 and netrom (bsc#1248687)
• CVE-2025-46836: Fixed stack buffer overflow caused by the absence of bound checks (bsc#1243581)

This update for net-tools fixes the following issues:

• Fixed stack buffer overflow in parse_hex, proc_gen_fmt, ax25 and netrom (bsc#1248687)
• Fixed stack overflow in ax25 and netrom (bsc#1248687)
• CVE-2025-46836: Fixed stack buffer overflow caused by the absence of bound checks (bsc#1243581)

This update for net-tools fixes the following issues:

• Fix stack buffer overflow in parse_hex (bsc#1248687, GHSA-h667-qrp8-gj58).
• Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687, GHSA-w7jq-cmw2-cq59).
• Avoid unsafe memcpy in ifconfig (bsc#1248687).
• Prevent overflow in ax25 and netrom (bsc#1248687)
• Keep possibility to enter long interface names, even if they are not accepted by the kernel, because it was always possible up to CVE-2025-46836 fix. But issue a warning about an interface name concatenation (bsc#1248410).

This update for net-tools fixes the following issues:

• Fix stack buffer overflow in parse_hex (bsc#1248687, GHSA-h667-qrp8-gj58).
• Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687, GHSA-w7jq-cmw2-cq59).
• Avoid unsafe memcpy in ifconfig (bsc#1248687).
• Prevent overflow in ax25 and netrom (bsc#1248687)
• Keep possibility to enter long interface names, even if they are not accepted by the kernel, because it was always possible up to CVE-2025-46836 fix. But issue a warning about an interface name concatenation (bsc#1248410).

It was discovered that net-tools incorrectly handled certain inputs. An attacker could possible use this issue to cause a crash or execute arbitrary code.