Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [Buildroot] [PATCH] package/net-tools: add upstream security fix for CVE-2025-46836
@ 2025-05-18 13:24 Peter Korsgaard
  2025-05-18 13:37 ` Thomas Petazzoni via buildroot
  2025-06-04 18:21 ` Arnout Vandecappelle via buildroot
  0 siblings, 2 replies; 3+ messages in thread
From: Peter Korsgaard @ 2025-05-18 13:24 UTC (permalink / raw)
  To: buildroot

Fixes the following security issue:

CVE-2025-46836: Stack-based Buffer Overflow in net-tools (get_name)

https://github.com/ecki/net-tools/security/advisories/GHSA-pfwf-h6m3-63wf

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 ...nterface.c-Stack-based-Buffer-Overfl.patch | 93 +++++++++++++++++++
 package/net-tools/net-tools.mk                |  3 +
 2 files changed, 96 insertions(+)
 create mode 100644 package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch

diff --git a/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch b/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
new file mode 100644
index 0000000000..0a02785f38
--- /dev/null
+++ b/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
@@ -0,0 +1,93 @@
+From 7a8f42fb20013a1493d8cae1c43436f85e656f2d Mon Sep 17 00:00:00 2001
+From: Zephkeks <zephyrofficialdiscord@gmail.com>
+Date: Tue, 13 May 2025 11:04:17 +0200
+Subject: [PATCH] CVE-2025-46836: interface.c: Stack-based Buffer Overflow in
+ get_name()
+
+Coordinated as GHSA-pfwf-h6m3-63wf
+
+Upstream: https://github.com/ecki/net-tools/commit/7a8f42fb20013a1493d8cae1c43436f85e656f2d
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ lib/interface.c | 63 ++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 39 insertions(+), 24 deletions(-)
+
+diff --git a/lib/interface.c b/lib/interface.c
+index 71d4163..a054f12 100644
+--- a/lib/interface.c
++++ b/lib/interface.c
+@@ -211,32 +211,47 @@ out:
+ }
+ 
+ static const char *get_name(char *name, const char *p)
++/* Safe version — guarantees at most IFNAMSIZ‑1 bytes are copied
++   and the destination buffer is always NUL‑terminated.             */
+ {
+-    while (isspace(*p))
+-	p++;
+-    while (*p) {
+-	if (isspace(*p))
+-	    break;
+-	if (*p == ':') {	/* could be an alias */
+-		const char *dot = p++;
+- 		while (*p && isdigit(*p)) p++;
+-		if (*p == ':') {
+-			/* Yes it is, backup and copy it. */
+-			p = dot;
+-			*name++ = *p++;
+-			while (*p && isdigit(*p)) {
+-				*name++ = *p++;
+-			}
+-		} else {
+-			/* No, it isn't */
+-			p = dot;
+-	    }
+-	    p++;
+-	    break;
+-	}
+-	*name++ = *p++;
++    char       *dst = name;                 /* current write ptr          */
++    const char *end = name + IFNAMSIZ - 1;  /* last byte we may write     */
++
++    /* Skip leading white‑space. */
++    while (isspace((unsigned char)*p))
++        ++p;
++
++    /* Copy until white‑space, end of string, or buffer full. */
++    while (*p && !isspace((unsigned char)*p) && dst < end) {
++        if (*p == ':') {                    /* possible alias veth0:123:  */
++            const char *dot = p;            /* remember the colon         */
++            ++p;
++            while (*p && isdigit((unsigned char)*p))
++                ++p;
++
++            if (*p == ':') {                /* confirmed alias            */
++                p = dot;                    /* rewind and copy it all     */
++
++                /* copy the colon */
++                if (dst < end)
++                    *dst++ = *p++;
++
++                /* copy the digits */
++                while (*p && isdigit((unsigned char)*p) && dst < end)
++                    *dst++ = *p++;
++
++                if (*p == ':')              /* consume trailing colon     */
++                    ++p;
++            } else {              /* if so treat as normal */
++                p = dot;
++            }
++            break;                          /* interface name ends here   */
++        }
++
++        *dst++ = *p++;                      /* ordinary character copy    */
+     }
+-    *name++ = '\0';
++
++    *dst = '\0';                            /* always NUL‑terminate       */
+     return p;
+ }
+ 
+-- 
+2.39.5
+
diff --git a/package/net-tools/net-tools.mk b/package/net-tools/net-tools.mk
index 03e1c73406..a227d6477f 100644
--- a/package/net-tools/net-tools.mk
+++ b/package/net-tools/net-tools.mk
@@ -12,6 +12,9 @@ NET_TOOLS_LICENSE = GPL-2.0+
 NET_TOOLS_LICENSE_FILES = COPYING
 NET_TOOLS_CPE_ID_VALID = YES
 
+# 0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
+NET_TOOLS_IGNORE_CVES += CVE-2025-46836
+
 define NET_TOOLS_CONFIGURE_CMDS
 	(cd $(@D); yes "" | ./configure.sh config.in )
 endef
-- 
2.39.5

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH] package/net-tools: add upstream security fix for CVE-2025-46836
  2025-05-18 13:24 [Buildroot] [PATCH] package/net-tools: add upstream security fix for CVE-2025-46836 Peter Korsgaard
@ 2025-05-18 13:37 ` Thomas Petazzoni via buildroot
  2025-06-04 18:21 ` Arnout Vandecappelle via buildroot
  1 sibling, 0 replies; 3+ messages in thread
From: Thomas Petazzoni via buildroot @ 2025-05-18 13:37 UTC (permalink / raw)
  To: Peter Korsgaard; +Cc: buildroot

On Sun, 18 May 2025 15:24:18 +0200
Peter Korsgaard <peter@korsgaard.com> wrote:

> Fixes the following security issue:
> 
> CVE-2025-46836: Stack-based Buffer Overflow in net-tools (get_name)
> 
> https://github.com/ecki/net-tools/security/advisories/GHSA-pfwf-h6m3-63wf
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
> ---
>  ...nterface.c-Stack-based-Buffer-Overfl.patch | 93 +++++++++++++++++++
>  package/net-tools/net-tools.mk                |  3 +
>  2 files changed, 96 insertions(+)
>  create mode 100644 package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH] package/net-tools: add upstream security fix for CVE-2025-46836
  2025-05-18 13:24 [Buildroot] [PATCH] package/net-tools: add upstream security fix for CVE-2025-46836 Peter Korsgaard
  2025-05-18 13:37 ` Thomas Petazzoni via buildroot
@ 2025-06-04 18:21 ` Arnout Vandecappelle via buildroot
  1 sibling, 0 replies; 3+ messages in thread
From: Arnout Vandecappelle via buildroot @ 2025-06-04 18:21 UTC (permalink / raw)
  To: Peter Korsgaard, buildroot



On 18/05/2025 15:24, Peter Korsgaard wrote:
> Fixes the following security issue:
> 
> CVE-2025-46836: Stack-based Buffer Overflow in net-tools (get_name)
> 
> https://github.com/ecki/net-tools/security/advisories/GHSA-pfwf-h6m3-63wf
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

  Applied to 2025.02.x, thanks.

  Regards,
  Arnout

> ---
>   ...nterface.c-Stack-based-Buffer-Overfl.patch | 93 +++++++++++++++++++
>   package/net-tools/net-tools.mk                |  3 +
>   2 files changed, 96 insertions(+)
>   create mode 100644 package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
> 
> diff --git a/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch b/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
> new file mode 100644
> index 0000000000..0a02785f38
> --- /dev/null
> +++ b/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
> @@ -0,0 +1,93 @@
> +From 7a8f42fb20013a1493d8cae1c43436f85e656f2d Mon Sep 17 00:00:00 2001
> +From: Zephkeks <zephyrofficialdiscord@gmail.com>
> +Date: Tue, 13 May 2025 11:04:17 +0200
> +Subject: [PATCH] CVE-2025-46836: interface.c: Stack-based Buffer Overflow in
> + get_name()
> +
> +Coordinated as GHSA-pfwf-h6m3-63wf
> +
> +Upstream: https://github.com/ecki/net-tools/commit/7a8f42fb20013a1493d8cae1c43436f85e656f2d
> +Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
> +---
> + lib/interface.c | 63 ++++++++++++++++++++++++++++++-------------------
> + 1 file changed, 39 insertions(+), 24 deletions(-)
> +
> +diff --git a/lib/interface.c b/lib/interface.c
> +index 71d4163..a054f12 100644
> +--- a/lib/interface.c
> ++++ b/lib/interface.c
> +@@ -211,32 +211,47 @@ out:
> + }
> +
> + static const char *get_name(char *name, const char *p)
> ++/* Safe version — guarantees at most IFNAMSIZ‑1 bytes are copied
> ++   and the destination buffer is always NUL‑terminated.             */
> + {
> +-    while (isspace(*p))
> +-	p++;
> +-    while (*p) {
> +-	if (isspace(*p))
> +-	    break;
> +-	if (*p == ':') {	/* could be an alias */
> +-		const char *dot = p++;
> +- 		while (*p && isdigit(*p)) p++;
> +-		if (*p == ':') {
> +-			/* Yes it is, backup and copy it. */
> +-			p = dot;
> +-			*name++ = *p++;
> +-			while (*p && isdigit(*p)) {
> +-				*name++ = *p++;
> +-			}
> +-		} else {
> +-			/* No, it isn't */
> +-			p = dot;
> +-	    }
> +-	    p++;
> +-	    break;
> +-	}
> +-	*name++ = *p++;
> ++    char       *dst = name;                 /* current write ptr          */
> ++    const char *end = name + IFNAMSIZ - 1;  /* last byte we may write     */
> ++
> ++    /* Skip leading white‑space. */
> ++    while (isspace((unsigned char)*p))
> ++        ++p;
> ++
> ++    /* Copy until white‑space, end of string, or buffer full. */
> ++    while (*p && !isspace((unsigned char)*p) && dst < end) {
> ++        if (*p == ':') {                    /* possible alias veth0:123:  */
> ++            const char *dot = p;            /* remember the colon         */
> ++            ++p;
> ++            while (*p && isdigit((unsigned char)*p))
> ++                ++p;
> ++
> ++            if (*p == ':') {                /* confirmed alias            */
> ++                p = dot;                    /* rewind and copy it all     */
> ++
> ++                /* copy the colon */
> ++                if (dst < end)
> ++                    *dst++ = *p++;
> ++
> ++                /* copy the digits */
> ++                while (*p && isdigit((unsigned char)*p) && dst < end)
> ++                    *dst++ = *p++;
> ++
> ++                if (*p == ':')              /* consume trailing colon     */
> ++                    ++p;
> ++            } else {              /* if so treat as normal */
> ++                p = dot;
> ++            }
> ++            break;                          /* interface name ends here   */
> ++        }
> ++
> ++        *dst++ = *p++;                      /* ordinary character copy    */
> +     }
> +-    *name++ = '\0';
> ++
> ++    *dst = '\0';                            /* always NUL‑terminate       */
> +     return p;
> + }
> +
> +--
> +2.39.5
> +
> diff --git a/package/net-tools/net-tools.mk b/package/net-tools/net-tools.mk
> index 03e1c73406..a227d6477f 100644
> --- a/package/net-tools/net-tools.mk
> +++ b/package/net-tools/net-tools.mk
> @@ -12,6 +12,9 @@ NET_TOOLS_LICENSE = GPL-2.0+
>   NET_TOOLS_LICENSE_FILES = COPYING
>   NET_TOOLS_CPE_ID_VALID = YES
>   
> +# 0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
> +NET_TOOLS_IGNORE_CVES += CVE-2025-46836
> +
>   define NET_TOOLS_CONFIGURE_CMDS
>   	(cd $(@D); yes "" | ./configure.sh config.in )
>   endef

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-06-04 18:21 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-05-18 13:24 [Buildroot] [PATCH] package/net-tools: add upstream security fix for CVE-2025-46836 Peter Korsgaard
2025-05-18 13:37 ` Thomas Petazzoni via buildroot
2025-06-04 18:21 ` Arnout Vandecappelle via buildroot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox