Control: tags 1105806 + patch Control: tags 1105806 + pending
Dear maintainer, I've prepared an NMU for net-tools (versioned as 2.10-1.2) and uploaded it to DELAYED/2. Please feel free to tell me if I should cancel it. Aiming to get the change in trixie ideally, thus already proposing the NMU, and uploading to delayed. Regards, Salvatore
diffstat for net-tools-2.10 net-tools-2.10 changelog | 8 patches/CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch | 92 ++++++++++ patches/series | 1 3 files changed, 101 insertions(+) diff -Nru net-tools-2.10/debian/changelog net-tools-2.10/debian/changelog --- net-tools-2.10/debian/changelog 2024-04-22 01:55:29.000000000 +0200 +++ net-tools-2.10/debian/changelog 2025-05-15 05:43:50.000000000 +0200 @@ -1,3 +1,11 @@ +net-tools (2.10-1.2) unstable; urgency=medium + + * Non-maintainer upload. + * CVE-2025-46836: interface.c: Stack-based Buffer Overflow in get_name() + (Closes: #1105806) + + -- Salvatore Bonaccorso <car...@debian.org> Thu, 15 May 2025 05:43:50 +0200 + net-tools (2.10-1.1) unstable; urgency=medium * Non-maintainer upload. diff -Nru net-tools-2.10/debian/patches/CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch net-tools-2.10/debian/patches/CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch --- net-tools-2.10/debian/patches/CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch 1970-01-01 01:00:00.000000000 +0100 +++ net-tools-2.10/debian/patches/CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch 2025-05-15 05:43:50.000000000 +0200 @@ -0,0 +1,92 @@ +From: Zephkeks <zephyrofficialdisc...@gmail.com> +Date: Tue, 13 May 2025 11:04:17 +0200 +Subject: CVE-2025-46836: interface.c: Stack-based Buffer Overflow in + get_name() +Origin: https://github.com/ecki/net-tools/commit/7a8f42fb20013a1493d8cae1c43436f85e656f2d +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-46836 +Bug-Debian: https://bugs.debian.org/1105806 + +Coordinated as GHSA-pfwf-h6m3-63wf +--- + lib/interface.c | 63 ++++++++++++++++++++++++++++++------------------- + 1 file changed, 39 insertions(+), 24 deletions(-) + +diff --git a/lib/interface.c b/lib/interface.c +index 71d4163ac36f..a054f126e2f1 100644 +--- a/lib/interface.c ++++ b/lib/interface.c +@@ -211,32 +211,47 @@ out: + } + + static const char *get_name(char *name, const char *p) ++/* Safe version ??? guarantees at most IFNAMSIZ???1 bytes are copied ++ and the destination buffer is always NUL???terminated. */ + { +- while (isspace(*p)) +- p++; +- while (*p) { +- if (isspace(*p)) +- break; +- if (*p == ':') { /* could be an alias */ +- const char *dot = p++; +- while (*p && isdigit(*p)) p++; +- if (*p == ':') { +- /* Yes it is, backup and copy it. */ +- p = dot; +- *name++ = *p++; +- while (*p && isdigit(*p)) { +- *name++ = *p++; +- } +- } else { +- /* No, it isn't */ +- p = dot; +- } +- p++; +- break; +- } +- *name++ = *p++; ++ char *dst = name; /* current write ptr */ ++ const char *end = name + IFNAMSIZ - 1; /* last byte we may write */ ++ ++ /* Skip leading white???space. */ ++ while (isspace((unsigned char)*p)) ++ ++p; ++ ++ /* Copy until white???space, end of string, or buffer full. */ ++ while (*p && !isspace((unsigned char)*p) && dst < end) { ++ if (*p == ':') { /* possible alias veth0:123: */ ++ const char *dot = p; /* remember the colon */ ++ ++p; ++ while (*p && isdigit((unsigned char)*p)) ++ ++p; ++ ++ if (*p == ':') { /* confirmed alias */ ++ p = dot; /* rewind and copy it all */ ++ ++ /* copy the colon */ ++ if (dst < end) ++ *dst++ = *p++; ++ ++ /* copy the digits */ ++ while (*p && isdigit((unsigned char)*p) && dst < end) ++ *dst++ = *p++; ++ ++ if (*p == ':') /* consume trailing colon */ ++ ++p; ++ } else { /* if so treat as normal */ ++ p = dot; ++ } ++ break; /* interface name ends here */ ++ } ++ ++ *dst++ = *p++; /* ordinary character copy */ + } +- *name++ = '\0'; ++ ++ *dst = '\0'; /* always NUL???terminate */ + return p; + } + +-- +2.49.0 + diff -Nru net-tools-2.10/debian/patches/series net-tools-2.10/debian/patches/series --- net-tools-2.10/debian/patches/series 2023-11-23 15:37:17.000000000 +0100 +++ net-tools-2.10/debian/patches/series 2025-05-15 05:43:50.000000000 +0200 @@ -3,3 +3,4 @@ Add_missing_headers.patch Bug_900962-man-de-typos.patch Bug_549397-fix-decoding-of-MII-vendor-ids.patch +CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
