From a28555b311e1fdb8c7b42e1d22f1315f74991f57 Mon Sep 17 00:00:00 2001 From: wubijie Date: Wed, 30 Jul 2025 11:17:52 +0800 Subject: [PATCH] fix CVE-2025-47268 --- backport-CVE-2025-48964.patch | 96 +++++++++++++++++++++++++++++++++++ iputils.spec | 9 +++- 2 files changed, 104 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2025-48964.patch diff --git a/backport-CVE-2025-48964.patch b/backport-CVE-2025-48964.patch new file mode 100644 index 0000000..60726c1 --- /dev/null +++ b/backport-CVE-2025-48964.patch @@ -0,0 +1,96 @@ +From afa36390394a6e0cceba03b52b59b6d41710608c Mon Sep 17 00:00:00 2001 +From: Cyril Hrubis +Date: Fri, 16 May 2025 17:57:10 +0200 +Subject: [PATCH] ping: Fix moving average rtt calculation + +The rts->rtt counts an exponential weight moving average in a fixed +point, that means that even if we limit the triptime to fit into a 32bit +number the average will overflow because because fixed point needs eight +more bits. + +We also have to limit the triptime to 32bit number because otherwise the +moving average may stil overflow if we manage to produce a large enough +triptime. + +Fixes: CVE-2025-48964 +Fixes: https://bugzilla.suse.com/show_bug.cgi?id=1243772 +Closes: https://github.com/iputils/iputils-ghsa-25fr-jw29-74f9/pull/1 +Reported-by: Mohamed Maatallah +Reviewed-by: Petr Vorel +Tested-by: Petr Vorel +Reviewed-by: Michal Kubecek +Reviewed-by: Mohamed Maatallah +Signed-off-by: Cyril Hrubis +--- + iputils_common.h | 2 +- + ping/ping.h | 2 +- + ping/ping_common.c | 8 ++++---- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/iputils_common.h b/iputils_common.h +index 829a7499..12969053 100644 +--- a/iputils_common.h ++++ b/iputils_common.h +@@ -11,7 +11,7 @@ + __typeof__(&arr[0]))])) * 0) + + /* 1000001 = 1000000 tv_sec + 1 tv_usec */ +-#define TV_SEC_MAX_VAL (LONG_MAX/1000001) ++#define TV_SEC_MAX_VAL (INT32_MAX/1000001) + + #ifdef __GNUC__ + # define iputils_attribute_format(t, n, m) __attribute__((__format__ (t, n, m))) +diff --git a/ping/ping.h b/ping/ping.h +index 4dce5386..bc1fab2b 100644 +--- a/ping/ping.h ++++ b/ping/ping.h +@@ -194,7 +194,7 @@ struct ping_rts { + long tmax; /* maximum round trip time */ + double tsum; /* sum of all times, for doing average */ + double tsum2; +- int rtt; ++ uint64_t rtt; /* Exponential weight moving average calculated in fixed point */ + int rtt_addend; + uint16_t acked; + int pipesize; +diff --git a/ping/ping_common.c b/ping/ping_common.c +index 2a3e5562..fad52280 100644 +--- a/ping/ping_common.c ++++ b/ping/ping_common.c +@@ -282,7 +282,7 @@ int __schedule_exit(int next) + + static inline void update_interval(struct ping_rts *rts) + { +- int est = rts->rtt ? rts->rtt / 8 : rts->interval * 1000; ++ int est = rts->rtt ? (int)(rts->rtt / 8) : rts->interval * 1000; + + rts->interval = (est + rts->rtt_addend + 500) / 1000; + if (rts->uid && rts->interval < MIN_USER_INTERVAL_MS) +@@ -798,7 +798,7 @@ int gather_statistics(struct ping_rts *rts, uint8_t *icmph, int icmplen, + if (triptime > rts->tmax) + rts->tmax = triptime; + if (!rts->rtt) +- rts->rtt = triptime * 8; ++ rts->rtt = ((uint64_t)triptime) * 8; + else + rts->rtt += triptime - rts->rtt / 8; + if (rts->opt_adaptive) +@@ -983,7 +983,7 @@ int finish(struct ping_rts *rts) + int ipg = (1000000 * (long long)tv.tv_sec + tv.tv_nsec / 1000) / (rts->ntransmitted - 1); + + printf(_("%sipg/ewma %d.%03d/%d.%03d ms"), +- comma, ipg / 1000, ipg % 1000, rts->rtt / 8000, (rts->rtt / 8) % 1000); ++ comma, ipg / 1000, ipg % 1000, (int)(rts->rtt / 8000), (int)((rts->rtt / 8) % 1000)); + } + putchar('\n'); + return (!rts->nreceived || (rts->deadline && rts->nreceived < rts->npackets)); +@@ -1008,7 +1008,7 @@ void status(struct ping_rts *rts) + fprintf(stderr, _(", min/avg/ewma/max = %ld.%03ld/%lu.%03ld/%d.%03d/%ld.%03ld ms"), + (long)rts->tmin / 1000, (long)rts->tmin % 1000, + tavg / 1000, tavg % 1000, +- rts->rtt / 8000, (rts->rtt / 8) % 1000, (long)rts->tmax / 1000, (long)rts->tmax % 1000); ++ (int)(rts->rtt / 8000), (int)((rts->rtt / 8) % 1000), (long)rts->tmax / 1000, (long)rts->tmax % 1000); + } + fprintf(stderr, "\n"); + } + diff --git a/iputils.spec b/iputils.spec index c0b204d..507d65e 100644 --- a/iputils.spec +++ b/iputils.spec @@ -1,6 +1,6 @@ Name: iputils Version: 20221126 -Release: 7 +Release: 8 Summary: Network monitoring tools including ping License: BSD and GPLv2+ URL: https://github.com/iputils/iputils @@ -31,6 +31,7 @@ Patch6009: backport-tracepath-Dont-assume-tv_sec-0-means-unset.patch Patch6010: backport-ping-check-return-value-of-write-to-avoid-integer-overflow.patch Patch6011: backport-ping-fix-IPv4-checksum-check-always-succeeding-once-again.patch Patch6012: backport-CVE-2025-47268.patch +Patch6013: backport-CVE-2025-48964.patch BuildRequires: gcc meson libidn2-devel openssl-devel libcap-devel libxslt BuildRequires: docbook5-style-xsl systemd iproute glibc-kernheaders gettext @@ -101,6 +102,12 @@ install -cp ifenslave.8 ${RPM_BUILD_ROOT}%{_mandir}/man8/ %{_mandir}/man8/*.8.gz %changelog +* Wed Jul 30 2025 wubijie - 20221126-8 +- Type:cves +- CVE:CVE-2025-48964 +- SUG:NA +- DESC:fix CVE-2025-48964 + * Tue Jul 22 2025 xinghe - 20221126-7 - Type:cves - CVE:CVE-2025-47268 -- Gitee