The BSD libc library's link_ntoa() function may be vulnerable to a classic buffer overflow

Published 8 y ago 2018-07-13 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

3.7%

percentile 90%

Public exploits

none known

Improper bounds checking of the obuf variable in the link_ntoa() function in linkaddr.c of the BSD libc library may allow an attacker to read or write from memory. The full impact and severity depends on the method of exploit and how the library is used by applications. According to analysis by FreeBSD developers, it is very unlikely that applications exist that utilize link_ntoa() in an exploitable manner, and the CERT/CC is not aware of any proof of concept. A blog post describes the functionality of link_ntoa() and points out that none of the base utilities use this function in an exploitable manner. For more information, please see FreeBSD Security Advisory SA-16:37.

Exploit prediction (EPSS)

3.65% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Affected products

BSD libc library

Classification

Weakness

CWE-120 Buffer Copy without Checking Size of Input
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

securitytracker.com /id/1037398 · vdb-entry, x_refsource_SECTRACK, x_transferred
freebsd.org /security/advisories/FreeBSD-SA-16:37.libc.asc · vendor-advisory, x_refsource_FREEBSD, x_transferred
kb.cert.org /vuls/id/548487 · third-party-advisory, x_refsource_CERT-VN, x_transferred
securityfocus.com /bid/94694 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2016-6559
NVD: CVE-2016-6559

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.