Re: [Buildroot] [PATCH] package/net-tools: add upstream security fix for CVE-2025-46836

[Arnout Vandecappelle via buildroot <buildroot@buildroot.org>]

On 18/05/2025 15:24, Peter Korsgaard wrote:
> Fixes the following security issue:
> 
> CVE-2025-46836: Stack-based Buffer Overflow in net-tools (get_name)
> 
> https://github.com/ecki/net-tools/security/advisories/GHSA-pfwf-h6m3-63wf
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

  Applied to 2025.02.x, thanks.

  Regards,
  Arnout

> ---
>   ...nterface.c-Stack-based-Buffer-Overfl.patch | 93 +++++++++++++++++++
>   package/net-tools/net-tools.mk                |  3 +
>   2 files changed, 96 insertions(+)
>   create mode 100644 package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
> 
> diff --git a/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch b/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
> new file mode 100644
> index 0000000000..0a02785f38
> --- /dev/null
> +++ b/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
> @@ -0,0 +1,93 @@
> +From 7a8f42fb20013a1493d8cae1c43436f85e656f2d Mon Sep 17 00:00:00 2001
> +From: Zephkeks <zephyrofficialdiscord@gmail.com>
> +Date: Tue, 13 May 2025 11:04:17 +0200
> +Subject: [PATCH] CVE-2025-46836: interface.c: Stack-based Buffer Overflow in
> + get_name()
> +
> +Coordinated as GHSA-pfwf-h6m3-63wf
> +
> +Upstream: https://github.com/ecki/net-tools/commit/7a8f42fb20013a1493d8cae1c43436f85e656f2d
> +Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
> +---
> + lib/interface.c | 63 ++++++++++++++++++++++++++++++-------------------
> + 1 file changed, 39 insertions(+), 24 deletions(-)
> +
> +diff --git a/lib/interface.c b/lib/interface.c
> +index 71d4163..a054f12 100644
> +--- a/lib/interface.c
> ++++ b/lib/interface.c
> +@@ -211,32 +211,47 @@ out:
> + }
> +
> + static const char *get_name(char *name, const char *p)
> ++/* Safe version — guarantees at most IFNAMSIZ‑1 bytes are copied
> ++   and the destination buffer is always NUL‑terminated.             */
> + {
> +-    while (isspace(*p))
> +-	p++;
> +-    while (*p) {
> +-	if (isspace(*p))
> +-	    break;
> +-	if (*p == ':') {	/* could be an alias */
> +-		const char *dot = p++;
> +- 		while (*p && isdigit(*p)) p++;
> +-		if (*p == ':') {
> +-			/* Yes it is, backup and copy it. */
> +-			p = dot;
> +-			*name++ = *p++;
> +-			while (*p && isdigit(*p)) {
> +-				*name++ = *p++;
> +-			}
> +-		} else {
> +-			/* No, it isn't */
> +-			p = dot;
> +-	    }
> +-	    p++;
> +-	    break;
> +-	}
> +-	*name++ = *p++;
> ++    char       *dst = name;                 /* current write ptr          */
> ++    const char *end = name + IFNAMSIZ - 1;  /* last byte we may write     */
> ++
> ++    /* Skip leading white‑space. */
> ++    while (isspace((unsigned char)*p))
> ++        ++p;
> ++
> ++    /* Copy until white‑space, end of string, or buffer full. */
> ++    while (*p && !isspace((unsigned char)*p) && dst < end) {
> ++        if (*p == ':') {                    /* possible alias veth0:123:  */
> ++            const char *dot = p;            /* remember the colon         */
> ++            ++p;
> ++            while (*p && isdigit((unsigned char)*p))
> ++                ++p;
> ++
> ++            if (*p == ':') {                /* confirmed alias            */
> ++                p = dot;                    /* rewind and copy it all     */
> ++
> ++                /* copy the colon */
> ++                if (dst < end)
> ++                    *dst++ = *p++;
> ++
> ++                /* copy the digits */
> ++                while (*p && isdigit((unsigned char)*p) && dst < end)
> ++                    *dst++ = *p++;
> ++
> ++                if (*p == ':')              /* consume trailing colon     */
> ++                    ++p;
> ++            } else {              /* if so treat as normal */
> ++                p = dot;
> ++            }
> ++            break;                          /* interface name ends here   */
> ++        }
> ++
> ++        *dst++ = *p++;                      /* ordinary character copy    */
> +     }
> +-    *name++ = '\0';
> ++
> ++    *dst = '\0';                            /* always NUL‑terminate       */
> +     return p;
> + }
> +
> +--
> +2.39.5
> +
> diff --git a/package/net-tools/net-tools.mk b/package/net-tools/net-tools.mk
> index 03e1c73406..a227d6477f 100644
> --- a/package/net-tools/net-tools.mk
> +++ b/package/net-tools/net-tools.mk
> @@ -12,6 +12,9 @@ NET_TOOLS_LICENSE = GPL-2.0+
>   NET_TOOLS_LICENSE_FILES = COPYING
>   NET_TOOLS_CPE_ID_VALID = YES
>   
> +# 0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
> +NET_TOOLS_IGNORE_CVES += CVE-2025-46836
> +
>   define NET_TOOLS_CONFIGURE_CMDS
>   	(cd $(@D); yes "" | ./configure.sh config.in )
>   endef

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot