Version in base suite: 2.10-0.1 Base version: net-tools_2.10-0.1 Target version: net-tools_2.10-0.1+deb12u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/net-tools/net-tools_2.10-0.1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/n/net-tools/net-tools_2.10-0.1+deb12u1.dsc changelog | 8 patches/CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch | 92 ++++++++++ patches/series | 1 3 files changed, 101 insertions(+) diff -Nru net-tools-2.10/debian/changelog net-tools-2.10/debian/changelog --- net-tools-2.10/debian/changelog 2022-11-25 14:15:20.000000000 +0000 +++ net-tools-2.10/debian/changelog 2025-05-15 03:52:03.000000000 +0000 @@ -1,3 +1,11 @@ +net-tools (2.10-0.1+deb12u1) bookworm-security; urgency=high + + * Non-maintainer upload by the Security Team. + * CVE-2025-46836: interface.c: Stack-based Buffer Overflow in get_name() + (Closes: #1105806) + + -- Salvatore Bonaccorso Thu, 15 May 2025 05:52:03 +0200 + net-tools (2.10-0.1) unstable; urgency=medium * Non-maintainer upload. diff -Nru net-tools-2.10/debian/patches/CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch net-tools-2.10/debian/patches/CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch --- net-tools-2.10/debian/patches/CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch 1970-01-01 00:00:00.000000000 +0000 +++ net-tools-2.10/debian/patches/CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch 2025-05-15 03:52:03.000000000 +0000 @@ -0,0 +1,92 @@ +From: Zephkeks +Date: Tue, 13 May 2025 11:04:17 +0200 +Subject: CVE-2025-46836: interface.c: Stack-based Buffer Overflow in + get_name() +Origin: https://github.com/ecki/net-tools/commit/7a8f42fb20013a1493d8cae1c43436f85e656f2d +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-46836 +Bug-Debian: https://bugs.debian.org/1105806 + +Coordinated as GHSA-pfwf-h6m3-63wf +--- + lib/interface.c | 63 ++++++++++++++++++++++++++++++------------------- + 1 file changed, 39 insertions(+), 24 deletions(-) + +diff --git a/lib/interface.c b/lib/interface.c +index 71d4163ac36f..a054f126e2f1 100644 +--- a/lib/interface.c ++++ b/lib/interface.c +@@ -211,32 +211,47 @@ out: + } + + static const char *get_name(char *name, const char *p) ++/* Safe version — guarantees at most IFNAMSIZ‑1 bytes are copied ++ and the destination buffer is always NUL‑terminated. */ + { +- while (isspace(*p)) +- p++; +- while (*p) { +- if (isspace(*p)) +- break; +- if (*p == ':') { /* could be an alias */ +- const char *dot = p++; +- while (*p && isdigit(*p)) p++; +- if (*p == ':') { +- /* Yes it is, backup and copy it. */ +- p = dot; +- *name++ = *p++; +- while (*p && isdigit(*p)) { +- *name++ = *p++; +- } +- } else { +- /* No, it isn't */ +- p = dot; +- } +- p++; +- break; +- } +- *name++ = *p++; ++ char *dst = name; /* current write ptr */ ++ const char *end = name + IFNAMSIZ - 1; /* last byte we may write */ ++ ++ /* Skip leading white‑space. */ ++ while (isspace((unsigned char)*p)) ++ ++p; ++ ++ /* Copy until white‑space, end of string, or buffer full. */ ++ while (*p && !isspace((unsigned char)*p) && dst < end) { ++ if (*p == ':') { /* possible alias veth0:123: */ ++ const char *dot = p; /* remember the colon */ ++ ++p; ++ while (*p && isdigit((unsigned char)*p)) ++ ++p; ++ ++ if (*p == ':') { /* confirmed alias */ ++ p = dot; /* rewind and copy it all */ ++ ++ /* copy the colon */ ++ if (dst < end) ++ *dst++ = *p++; ++ ++ /* copy the digits */ ++ while (*p && isdigit((unsigned char)*p) && dst < end) ++ *dst++ = *p++; ++ ++ if (*p == ':') /* consume trailing colon */ ++ ++p; ++ } else { /* if so treat as normal */ ++ p = dot; ++ } ++ break; /* interface name ends here */ ++ } ++ ++ *dst++ = *p++; /* ordinary character copy */ + } +- *name++ = '\0'; ++ ++ *dst = '\0'; /* always NUL‑terminate */ + return p; + } + +-- +2.49.0 + diff -Nru net-tools-2.10/debian/patches/series net-tools-2.10/debian/patches/series --- net-tools-2.10/debian/patches/series 2022-11-25 14:01:58.000000000 +0000 +++ net-tools-2.10/debian/patches/series 2025-05-15 03:52:03.000000000 +0000 @@ -3,3 +3,4 @@ Add_missing_headers.patch Bug_900962-man-de-typos.patch Bug_549397-fix-decoding-of-MII-vendor-ids.patch +CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch