GHSA-25gm-4x89-7r2q: netopeer2-server logging has format string vulnerability via subtree filter
Netopeer2 is a server for implementing network configuration management based on the NETCONF Protocol. In affected versions, a low-privileged authenticated NETCONF user can remotely crash netopeer2-server by sending a get RPC with an invalid subtree filter whose text contains format specifiers. In src/netconf.c, np2srvrpcgetcb() sends the invalid value through ERR() to np2logprintf(), where vsnprintf() first formats the message safely. In src/log.c, that already formatted buffer is subsequently passed to np2log() as the format string itself, causing vsyslog() to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using NETCONF-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. The advisory identifies 2.8.8 as patched; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
netopeer2-serverto a version that resolves this vulnerability.Fixed in 2.8.21
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged authenticated NETCONF user can exploit it remotely. The reported attack path uses NETCONF over SSH and does not require user interaction.
What input triggers the crash?
The attacker sends a get RPC containing an invalid subtree filter whose text includes format specifiers. Those percent sequences are later interpreted as a logging format string, which can cause invalid pointer reads and crash netopeer2-server.
Is remote code execution confirmed?
No. The report confirmed remote denial of service, but did not confirm reliable remote code execution.
Which versions are known to be affected or fixed?
The denial of service was confirmed on version 2.8.7. The advisory identifies 2.8.8 as patched, and the fix is verified in public release 2.8.21; however, no public 2.8.8 tag was found, so the exact affected-to-fixed boundary remains unresolved.