CVE-2025-46836

What it actually does

get_name() in interface.c reads interface names from /proc/net/dev into a fixed 16-byte stack buffer without length validation, enabling out-of-bounds writes that can corrupt adjacent stack data and result in crashes or arbitrary code execution.

Why it matters to the business

Local users on affected systems can trigger crashes of network utilities or potentially execute code, leading to service disruption and the need for urgent patching of net-tools packages across Linux deployments.

How an attack unfolds

An attacker with local access invokes a network utility such as ifconfig that calls get_name(); the function reads an oversized interface label from /proc/net/dev, overflows the stack buffer, and either crashes the process or achieves code execution within the utility's context without gaining elevated privileges.

How to fix it

Upgrade net-tools to version 2.20 or later. For the listed linux-aws-5.15 package on Ubuntu 20.04 LTS, apply the fixed version 5.15.0-1072.78~20.04.1 via package manager and restart affected services.

How to confirm the fix worked

Confirm the installed net-tools version is at least 2.20, verify the patch is present in interface.c by checking that get_name() performs bounds-checked copying, and test that oversized interface names in /proc/net/dev no longer cause overflows.

Typical attack path

1. Obtain local shell access on a system using net-tools <= 2.10
2. Trigger ifconfig or similar utility that parses /proc/net/dev
3. Supply or observe an interface label exceeding 15 bytes
4. Overflow the fixed buffer in get_name() to corrupt stack memory
5. Cause denial of service via crash or attempt code execution

How to detect it

Search system and application logs for segmentation faults or crashes involving ifconfig, netstat, or other net-tools binaries; inspect /proc/net/dev contents for unusually long interface names; review process core dumps for stack buffer overflows originating from interface.c.

What your security team should do

• Immediately update net-tools packages to the fixed versions on all affected systems
• Prioritize patching internet-facing or multi-user Linux hosts due to local exploitability
• Monitor for crashes of ifconfig and related utilities in system logs
• Restrict local user accounts where feasible until patches are deployed