Pre-authentication buffer overflow in GNU InetUtils telnetd's LINEMODE SLC (Set Local Characters) handler.
CVSS 3.1: 9.8 (Critical) | CWE: CWE-120, CWE-787
The add_slc() function in telnetd/slc.c appends 3 bytes per SLC triplet to a fixed 108-byte buffer (slcbuf) without bounds checking. An unauthenticated attacker can send a crafted SLC suboption with 40+ triplets (function codes > 18/NSLC) during option negotiation - before any login prompt - overflowing the buffer and corrupting the slcptr pointer and adjacent data in BSS.
- GNU InetUtils telnetd through 2.7 (all versions)
- Any telnetd derived from the BSD SLC codebase
- Patch expected by April 1, 2026
- ✅ Triggers the buffer overflow and verifies it via SLC response analysis (leaked BSS data)
- ❌ Does NOT achieve code execution (no shellcode/ROP chain)
# Build the vulnerable lab environment
docker compose up -d
# Detect (non-destructive)
python3 detect.py 127.0.0.1 2323
# Exploit (triggers overflow, verifies via response)
python3 exploit.py 127.0.0.1 2323
# Clean up
docker compose downThe Docker setup runs a Debian container with inetutils-telnetd 2.4 under xinetd, exposed on port 2323. Fully isolated - nothing touches your host.
- Connect to telnetd and complete initial option negotiation
- Client proactively sends
WILL LINEMODEto trigger LINEMODE negotiation - Server responds with
DO LINEMODEand enters SLC suboption processing - Client sends a crafted SLC suboption containing 40-60 triplets with function codes > 18 (NSLC)
add_slc()queues a "not supported" reply (3 bytes) for each triplet into a 104-byte buffer- After ~35 triplets, the buffer overflows, corrupting
slcptrand adjacent BSS data end_slc()sends everything fromslcbufto the corruptedslcptrposition, including leaked BSS memory in the response- The server process remains alive; the overflow is confirmed by the oversized SLC response
| File | Description |
|---|---|
exploit.py |
PoC overflow with response-based verification |
Dockerfile |
Vulnerable telnetd lab |
docker-compose.yml |
One-command lab setup |
xinetd-telnet.conf |
xinetd service config |
detect.py |
Non-destructive version detection script |
For deep exploitation analysis including byte constraints, alignment techniques, and the def_slcbuf/free() primitive on 32-bit systems, see WatchTowr's writeup.
This tool is provided for authorized security testing and educational purposes only. Do not use against systems you do not own or have explicit permission to test. The author is not responsible for misuse.
- Vulnerability discovered by: Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel (DREAM Security Research Team)
MIT
