Description
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | inetutils | 2:2.3-5 | — |
| Debian 13 | inetutils | 2:2.3-5 | — |
| Debian 12 | inetutils | 2:2.3-5 | — |
| Debian 10 | inetutils | 2:1.9.4-7+deb10u2 | DLA-3205-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | inetutils | 2:2.2-2ubuntu0.1 | USN-6304-1 |
| Ubuntu 20.04 LTS | inetutils | 2:1.9.4-11ubuntu0.2 | USN-6304-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | inetutils | 2:1.9.4-3ubuntu0.1+esm2 | USN-7781-1 |
| Ubuntu Pro 16.04 LTS | inetutils | 2:1.9.4-1ubuntu0.1~esm3 | USN-7781-1 |
| Ubuntu Pro 14.04 LTS | inetutils | 2:1.9.2-1ubuntu0.1~esm2 | USN-7781-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SLES 15 SP3 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SLES 15 SP2 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SLES 15 SP1 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SLES 15 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
Show 19 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | krb5-appl | 1.0.3-3.9.1 | SUSE-SU-2022:3471-1 |
| SLES 12 SP5 | telnet | 1.2-167.10.1 | SUSE-SU-2022:3735-1 |
| SLES 12 SP4 | krb5-appl | 1.0.3-3.9.1 | SUSE-SU-2022:3471-1 |
| SLES 12 SP4 | telnet | 1.2-167.10.1 | SUSE-SU-2022:3735-1 |
| SLES 12 SP3 | krb5-appl | 1.0.3-3.9.1 | SUSE-SU-2022:3471-1 |
| SLES 12 SP3 | telnet | 1.2-167.10.1 | SUSE-SU-2022:3735-1 |
| SLES 12 SP2 | krb5-appl | 1.0.3-3.9.1 | SUSE-SU-2022:3471-1 |
| SLES 12 SP2 | telnet | 1.2-167.10.1 | SUSE-SU-2022:3735-1 |
| SLES for SAP 15 SP2 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SLES for SAP 15 SP1 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SLES for SAP 15 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SLES for SAP 12 SP5 | krb5-appl | 1.0.3-3.9.1 | SUSE-SU-2022:3471-1 |
| SLES for SAP 12 SP5 | telnet | 1.2-167.10.1 | SUSE-SU-2022:3735-1 |
| SLES for SAP 12 SP4 | krb5-appl | 1.0.3-3.9.1 | SUSE-SU-2022:3471-1 |
| SLES for SAP 12 SP4 | telnet | 1.2-167.10.1 | SUSE-SU-2022:3735-1 |
| SLE HPC 15 SP2 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SLE HPC 15 SP1 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SLE HPC 15 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SUSE OpenStack Cloud Crowbar 9 | krb5-appl | 1.0.3-3.9.1 | SUSE-SU-2022:3471-1 |
| SUSE OpenStack Cloud Crowbar 9 | telnet | 1.2-167.10.1 | SUSE-SU-2022:3735-1 |
| SUSE OpenStack Cloud 9 | krb5-appl | 1.0.3-3.9.1 | SUSE-SU-2022:3471-1 |
| SUSE OpenStack Cloud 9 | telnet | 1.2-167.10.1 | SUSE-SU-2022:3735-1 |
| SUSE Manager Server 4.1 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SUSE Manager Retail Branch Server 4.1 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SUSE Manager Proxy 4.1 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SUSE Enterprise Storage 7 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| SUSE Enterprise Storage 6 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
| openSUSE Leap 15.3 | telnet | 1.2-150000.3.6.1 | SUSE-SU-2022:3783-1 |
Advisories 8
- WID-SEC-2025-1439 Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-7781-1 inetutils vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3205-1 inetutils - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-6304-1 inetutils vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2022:3735-1 Security update for telnet SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3471-1 Security update for krb5-appl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3783-1 Security update for telnet SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://lists.gnu.org/archive/html/bug-inetutils/2022-08/msg00002.html
- https://pierrekim.github.io/blog/2022-08-24-2-byte-dos-freebsd-netbsd-telnetd-netkit-telnetd-inetutils-telnetd-kerberos-telnetd.html
- https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=113da8021710d871c7dd72d2a4d5615d42d64289
- [debian-lts-announce] 20221125 [SECURITY] [DLA 3205-1] inetutils security update mailing-list