rpms/iputils
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping

Browse Source 
Resolves: RHEL-94334
This commit is contained in:
Jan Macku 2025-06-03 15:25:22 +02:00
parent fa76812bd1
commit c0ae22ecf0
2 changed files with 143 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

138
013-ping-Fix-signed-64-bit-integer-overflow-in-RTT-calcu.patch Normal file
View File

@ -0,0 +1,138 @@
From bbfda58c590a7f5f98653fcefcfd3d3255a0c98c Mon Sep 17 00:00:00 2001
From: Petr Vorel <pvorel@suse.cz>
Date: Mon, 5 May 2025 23:55:57 +0200
Subject: [PATCH] ping: Fix signed 64-bit integer overflow in RTT calculation
Crafted ICMP Echo Reply packet can cause signed integer overflow in
1) triptime calculation:
triptime = tv->tv_sec * 1000000 + tv->tv_usec;
2) tsum2 increment which uses triptime
rts->tsum2 += (double)((long long)triptime * (long long)triptime);
3) final tmvar:
tmvar = (rts->tsum2 / total) - (tmavg * tmavg)
$ export CFLAGS="-O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer"
$ export LDFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer"
$ meson setup .. -Db_sanitize=address,undefined
$ ninja
$ ./ping/ping -c2 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.061 ms
../ping/ping_common.c:757:25: runtime error: signed integer overflow: -2513732689199106 * 1000000 cannot be represented in type 'long int'
../ping/ping_common.c:757:12: runtime error: signed integer overflow: -4975495174606980224 + -6510615555425289427 cannot be represented in type 'long int'
../ping/ping_common.c:769:47: runtime error: signed integer overflow: 6960633343677281965 * 6960633343677281965 cannot be represented in type 'long int'
24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
./ping/ping: Warning: time of day goes back (-7256972569576721377us), taking countermeasures
./ping/ping: Warning: time of day goes back (-7256972569576721232us), taking countermeasures
24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
../ping/ping_common.c:265:16: runtime error: signed integer overflow: 6960633343677281965 * 2 cannot be represented in type 'long int'
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.565 ms
--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, +2 duplicates, 0% packet loss, time 1002ms
../ping/ping_common.c:940:42: runtime error: signed integer overflow: 1740158335919320832 * 1740158335919320832 cannot be represented in type 'long int'
rtt min/avg/max/mdev = 0.000/1740158335919320.832/6960633343677281.965/-1623514645242292.-224 ms
To fix the overflow check allowed ranges of struct timeval members:
* tv_sec <0, LONG_MAX/1000000>
* tv_usec <0, 999999>
Fix includes 2 new error messages (needs translation).
Also existing message "time of day goes back ..." needed to be modified
as it now prints tv->tv_sec which is a second (needs translation update).
After fix:
$ ./ping/ping -c2 127.0.0.1
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.057 ms
./ping/ping: Warning: invalid tv_usec -6510615555424928611 us
./ping/ping: Warning: time of day goes back (-3985394643238914 s), taking countermeasures
./ping/ping: Warning: invalid tv_usec -6510615555424928461 us
./ping/ping: Warning: time of day goes back (-3985394643238914 s), taking countermeasures
24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
./ping/ping: Warning: invalid tv_usec -6510615555425884541 us
./ping/ping: Warning: time of day goes back (-4243165695442945 s), taking countermeasures
24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.111 ms
--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, +2 duplicates, 0% packet loss, time 101ms
rtt min/avg/max/mdev = 0.000/0.042/0.111/0.046 ms
Fixes: https://github.com/iputils/iputils/issues/584
Fixes: CVE-2025-47268
Link: https://github.com/Zephkek/ping-rtt-overflow/
Co-developed-by: Cyril Hrubis <chrubis@suse.cz>
Reported-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
Reviewed-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
Reviewed-by: Noah Meyerhans <noahm@debian.org>
Signed-off-by: Petr Vorel <pvorel@suse.cz>
(cherry picked from commit 070cfacd7348386173231fb16fad4983d4e6ae40)
Signed-off-by: Jan Macku <jamacku@redhat.com>
---
iputils_common.h | 3 +++
ping/ping_common.c | 22 +++++++++++++++++++---
2 files changed, 22 insertions(+), 3 deletions(-)
diff --git a/iputils_common.h b/iputils_common.h
index 26e8f7c..d3070cb 100644
--- a/iputils_common.h
+++ b/iputils_common.h
@@ -10,6 +10,9 @@
!!__builtin_types_compatible_p(__typeof__(arr), \
__typeof__(&arr[0]))])) * 0)
+/* 1000001 = 1000000 tv_sec + 1 tv_usec */
+#define TV_SEC_MAX_VAL (LONG_MAX/1000001)
+
#ifdef __GNUC__
# define iputils_attribute_format(t, n, m) __attribute__((__format__ (t, n, m)))
#else
diff --git a/ping/ping_common.c b/ping/ping_common.c
index 0336259..1c8916f 100644
--- a/ping/ping_common.c
+++ b/ping/ping_common.c
@@ -728,16 +728,32 @@ int gather_statistics(struct ping_rts *rts, uint8_t *icmph, int icmplen,
restamp:
tvsub(tv, &tmp_tv);
- triptime = tv->tv_sec * 1000000 + tv->tv_usec;
- if (triptime < 0) {
- error(0, 0, _("Warning: time of day goes back (%ldus), taking countermeasures"), triptime);
+
+ if (tv->tv_usec >= 1000000) {
+ error(0, 0, _("Warning: invalid tv_usec %ld us"), tv->tv_usec);
+ tv->tv_usec = 999999;
+ }
+
+ if (tv->tv_usec < 0) {
+ error(0, 0, _("Warning: invalid tv_usec %ld us"), tv->tv_usec);
+ tv->tv_usec = 0;
+ }
+
+ if (tv->tv_sec > TV_SEC_MAX_VAL) {
+ error(0, 0, _("Warning: invalid tv_sec %ld s"), tv->tv_sec);
+ triptime = 0;
+ } else if (tv->tv_sec < 0) {
+ error(0, 0, _("Warning: time of day goes back (%ld s), taking countermeasures"), tv->tv_sec);
triptime = 0;
if (!rts->opt_latency) {
gettimeofday(tv, NULL);
rts->opt_latency = 1;
goto restamp;
}
+ } else {
+ triptime = tv->tv_sec * 1000000 + tv->tv_usec;
}
+
if (!csfailed) {
rts->tsum += triptime;
rts->tsum2 += (double)((long long)triptime * (long long)triptime);
--
2.49.0

6
iputils.spec
View File

@ -3,7 +3,7 @@
Summary: Network monitoring tools including ping
Name: iputils
Version: 20210202
Release: 11%{?dist}
Release: 12%{?dist}
# some parts are under the original BSD (ping.c)
# some are under GPLv2+ (tracepath.c)
License: BSD and GPLv2+
@ -31,6 +31,7 @@ Patch009: 009-ping-Print-reply-with-wrong-source-with-warning.patch
Patch010: 010-ping-Fix-socket-error-reporting.patch
Patch011: 011-ping-Fix-ping6-binding-to-VRF-and-address.patch
Patch012: 012-ping6-Avoid-binding-to-non-VRF.patch
Patch013: 013-ping-Fix-signed-64-bit-integer-overflow-in-RTT-calcu.patch
# Downstream-only patches
Patch100: 100-iputils-ifenslave.patch
@ -141,6 +142,9 @@ install -cp ifenslave.8 ${RPM_BUILD_ROOT}%{_mandir}/man8/
%attr(644,root,root) %{_mandir}/man8/ninfod.8.gz
%changelog
* Tue Jun 03 2025 Jan Macku <jamacku@redhat.com> - 20210202-12
- Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94334)
* Fri Sep 06 2024 Jan Macku <jamacku@redhat.com> - 20210202-11
- ping: Fix ping6 binding to VRF and address (RHEL-57734)