Complete Yocto mirror with license table for TQMa6UL (2038-compliance)
- 264 license table entries with exact download URLs (224/264 resolved) - Complete sources/ directory with all BitBake recipes - Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl) - Full traceability for Softwarefreigabeantrag - GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4 - License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
This commit is contained in:
Siggi (OpenClaw Agent)
@@ -0,0 +1,143 @@
|
||||
From 070cfacd7348386173231fb16fad4983d4e6ae40 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Vorel <pvorel@suse.cz>
|
||||
Date: Mon, 5 May 2025 23:55:57 +0200
|
||||
Subject: [PATCH] ping: Fix signed 64-bit integer overflow in RTT calculation
|
||||
|
||||
Crafted ICMP Echo Reply packet can cause signed integer overflow in
|
||||
|
||||
1) triptime calculation:
|
||||
triptime = tv->tv_sec * 1000000 + tv->tv_usec;
|
||||
|
||||
2) tsum2 increment which uses triptime
|
||||
rts->tsum2 += (double)((long long)triptime * (long long)triptime);
|
||||
|
||||
3) final tmvar:
|
||||
tmvar = (rts->tsum2 / total) - (tmavg * tmavg)
|
||||
|
||||
$ export CFLAGS="-O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer"
|
||||
$ export LDFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer"
|
||||
$ meson setup .. -Db_sanitize=address,undefined
|
||||
$ ninja
|
||||
$ ./ping/ping -c2 127.0.0.1
|
||||
|
||||
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
|
||||
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.061 ms
|
||||
../ping/ping_common.c:757:25: runtime error: signed integer overflow: -2513732689199106 * 1000000 cannot be represented in type 'long int'
|
||||
../ping/ping_common.c:757:12: runtime error: signed integer overflow: -4975495174606980224 + -6510615555425289427 cannot be represented in type 'long int'
|
||||
../ping/ping_common.c:769:47: runtime error: signed integer overflow: 6960633343677281965 * 6960633343677281965 cannot be represented in type 'long int'
|
||||
24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
|
||||
./ping/ping: Warning: time of day goes back (-7256972569576721377us), taking countermeasures
|
||||
./ping/ping: Warning: time of day goes back (-7256972569576721232us), taking countermeasures
|
||||
24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
|
||||
../ping/ping_common.c:265:16: runtime error: signed integer overflow: 6960633343677281965 * 2 cannot be represented in type 'long int'
|
||||
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.565 ms
|
||||
|
||||
--- 127.0.0.1 ping statistics ---
|
||||
2 packets transmitted, 2 received, +2 duplicates, 0% packet loss, time 1002ms
|
||||
../ping/ping_common.c:940:42: runtime error: signed integer overflow: 1740158335919320832 * 1740158335919320832 cannot be represented in type 'long int'
|
||||
rtt min/avg/max/mdev = 0.000/1740158335919320.832/6960633343677281.965/-1623514645242292.-224 ms
|
||||
|
||||
To fix the overflow check allowed ranges of struct timeval members:
|
||||
* tv_sec <0, LONG_MAX/1000000>
|
||||
* tv_usec <0, 999999>
|
||||
|
||||
Fix includes 2 new error messages (needs translation).
|
||||
Also existing message "time of day goes back ..." needed to be modified
|
||||
as it now prints tv->tv_sec which is a second (needs translation update).
|
||||
|
||||
After fix:
|
||||
|
||||
$ ./ping/ping -c2 127.0.0.1
|
||||
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.057 ms
|
||||
./ping/ping: Warning: invalid tv_usec -6510615555424928611 us
|
||||
./ping/ping: Warning: time of day goes back (-3985394643238914 s), taking countermeasures
|
||||
./ping/ping: Warning: invalid tv_usec -6510615555424928461 us
|
||||
./ping/ping: Warning: time of day goes back (-3985394643238914 s), taking countermeasures
|
||||
24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
|
||||
./ping/ping: Warning: invalid tv_usec -6510615555425884541 us
|
||||
./ping/ping: Warning: time of day goes back (-4243165695442945 s), taking countermeasures
|
||||
24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
|
||||
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.111 ms
|
||||
|
||||
--- 127.0.0.1 ping statistics ---
|
||||
2 packets transmitted, 2 received, +2 duplicates, 0% packet loss, time 101ms
|
||||
rtt min/avg/max/mdev = 0.000/0.042/0.111/0.046 ms
|
||||
|
||||
Fixes: https://github.com/iputils/iputils/issues/584
|
||||
Fixes: CVE-2025-472
|
||||
Link: https://github.com/Zephkek/ping-rtt-overflow/
|
||||
Co-developed-by: Cyril Hrubis <chrubis@suse.cz>
|
||||
Reported-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
|
||||
Reviewed-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
|
||||
Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
|
||||
Reviewed-by: Noah Meyerhans <noahm@debian.org>
|
||||
Signed-off-by: Petr Vorel <pvorel@suse.cz>
|
||||
|
||||
CVE: CVE-2025-47268
|
||||
|
||||
Upstream-Status: Backport
|
||||
[https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40]
|
||||
|
||||
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
|
||||
---
|
||||
iputils_common.h | 3 +++
|
||||
ping/ping_common.c | 22 +++++++++++++++++++---
|
||||
2 files changed, 22 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/iputils_common.h b/iputils_common.h
|
||||
index 49e790d..829a749 100644
|
||||
--- a/iputils_common.h
|
||||
+++ b/iputils_common.h
|
||||
@@ -10,6 +10,9 @@
|
||||
!!__builtin_types_compatible_p(__typeof__(arr), \
|
||||
__typeof__(&arr[0]))])) * 0)
|
||||
|
||||
+/* 1000001 = 1000000 tv_sec + 1 tv_usec */
|
||||
+#define TV_SEC_MAX_VAL (LONG_MAX/1000001)
|
||||
+
|
||||
#ifdef __GNUC__
|
||||
# define iputils_attribute_format(t, n, m) __attribute__((__format__ (t, n, m)))
|
||||
#else
|
||||
diff --git a/ping/ping_common.c b/ping/ping_common.c
|
||||
index dadd2a4..4e99d89 100644
|
||||
--- a/ping/ping_common.c
|
||||
+++ b/ping/ping_common.c
|
||||
@@ -754,16 +754,32 @@ int gather_statistics(struct ping_rts *rts, uint8_t *icmph, int icmplen,
|
||||
|
||||
restamp:
|
||||
tvsub(tv, &tmp_tv);
|
||||
- triptime = tv->tv_sec * 1000000 + tv->tv_usec;
|
||||
- if (triptime < 0) {
|
||||
- error(0, 0, _("Warning: time of day goes back (%ldus), taking countermeasures"), triptime);
|
||||
+
|
||||
+ if (tv->tv_usec >= 1000000) {
|
||||
+ error(0, 0, _("Warning: invalid tv_usec %ld us"), tv->tv_usec);
|
||||
+ tv->tv_usec = 999999;
|
||||
+ }
|
||||
+
|
||||
+ if (tv->tv_usec < 0) {
|
||||
+ error(0, 0, _("Warning: invalid tv_usec %ld us"), tv->tv_usec);
|
||||
+ tv->tv_usec = 0;
|
||||
+ }
|
||||
+
|
||||
+ if (tv->tv_sec > TV_SEC_MAX_VAL) {
|
||||
+ error(0, 0, _("Warning: invalid tv_sec %ld s"), tv->tv_sec);
|
||||
+ triptime = 0;
|
||||
+ } else if (tv->tv_sec < 0) {
|
||||
+ error(0, 0, _("Warning: time of day goes back (%ld s), taking countermeasures"), tv->tv_sec);
|
||||
triptime = 0;
|
||||
if (!rts->opt_latency) {
|
||||
gettimeofday(tv, NULL);
|
||||
rts->opt_latency = 1;
|
||||
goto restamp;
|
||||
}
|
||||
+ } else {
|
||||
+ triptime = tv->tv_sec * 1000000 + tv->tv_usec;
|
||||
}
|
||||
+
|
||||
if (!csfailed) {
|
||||
rts->tsum += triptime;
|
||||
rts->tsum2 += (double)((long long)triptime * (long long)triptime);
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@@ -0,0 +1,99 @@
|
||||
From afa36390394a6e0cceba03b52b59b6d41710608c Mon Sep 17 00:00:00 2001
|
||||
From: Cyril Hrubis <metan@ucw.cz>
|
||||
Date: Fri, 16 May 2025 17:57:10 +0200
|
||||
Subject: [PATCH] ping: Fix moving average rtt calculation
|
||||
|
||||
The rts->rtt counts an exponential weight moving average in a fixed
|
||||
point, that means that even if we limit the triptime to fit into a 32bit
|
||||
number the average will overflow because because fixed point needs eight
|
||||
more bits.
|
||||
|
||||
We also have to limit the triptime to 32bit number because otherwise the
|
||||
moving average may stil overflow if we manage to produce a large enough
|
||||
triptime.
|
||||
|
||||
Fixes: CVE-2025-48964
|
||||
Fixes: https://bugzilla.suse.com/show_bug.cgi?id=1243772
|
||||
Closes: https://github.com/iputils/iputils-ghsa-25fr-jw29-74f9/pull/1
|
||||
Reported-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
|
||||
Reviewed-by: Petr Vorel <pvorel@suse.cz>
|
||||
Tested-by: Petr Vorel <pvorel@suse.cz>
|
||||
Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
|
||||
Reviewed-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
|
||||
Signed-off-by: Cyril Hrubis <metan@ucw.cz>
|
||||
|
||||
CVE: CVE-2025-48964
|
||||
Upstream-Status: Backport [https://github.com/iputils/iputils/commit/afa36390394a6e0cceba03b52b59b6d41710608c]
|
||||
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
||||
---
|
||||
iputils_common.h | 2 +-
|
||||
ping/ping.h | 2 +-
|
||||
ping/ping_common.c | 8 ++++----
|
||||
3 files changed, 6 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/iputils_common.h b/iputils_common.h
|
||||
index 829a749..1296905 100644
|
||||
--- a/iputils_common.h
|
||||
+++ b/iputils_common.h
|
||||
@@ -11,7 +11,7 @@
|
||||
__typeof__(&arr[0]))])) * 0)
|
||||
|
||||
/* 1000001 = 1000000 tv_sec + 1 tv_usec */
|
||||
-#define TV_SEC_MAX_VAL (LONG_MAX/1000001)
|
||||
+#define TV_SEC_MAX_VAL (INT32_MAX/1000001)
|
||||
|
||||
#ifdef __GNUC__
|
||||
# define iputils_attribute_format(t, n, m) __attribute__((__format__ (t, n, m)))
|
||||
diff --git a/ping/ping.h b/ping/ping.h
|
||||
index 4dce538..bc1fab2 100644
|
||||
--- a/ping/ping.h
|
||||
+++ b/ping/ping.h
|
||||
@@ -191,7 +191,7 @@ struct ping_rts {
|
||||
long tmax; /* maximum round trip time */
|
||||
double tsum; /* sum of all times, for doing average */
|
||||
double tsum2;
|
||||
- int rtt;
|
||||
+ uint64_t rtt; /* Exponential weight moving average calculated in fixed point */
|
||||
int rtt_addend;
|
||||
uint16_t acked;
|
||||
int pipesize;
|
||||
diff --git a/ping/ping_common.c b/ping/ping_common.c
|
||||
index 2a3e556..fad5228 100644
|
||||
--- a/ping/ping_common.c
|
||||
+++ b/ping/ping_common.c
|
||||
@@ -282,7 +282,7 @@ int __schedule_exit(int next)
|
||||
|
||||
static inline void update_interval(struct ping_rts *rts)
|
||||
{
|
||||
- int est = rts->rtt ? rts->rtt / 8 : rts->interval * 1000;
|
||||
+ int est = rts->rtt ? (int)(rts->rtt / 8) : rts->interval * 1000;
|
||||
|
||||
rts->interval = (est + rts->rtt_addend + 500) / 1000;
|
||||
if (rts->uid && rts->interval < MIN_USER_INTERVAL_MS)
|
||||
@@ -778,7 +778,7 @@ restamp:
|
||||
if (triptime > rts->tmax)
|
||||
rts->tmax = triptime;
|
||||
if (!rts->rtt)
|
||||
- rts->rtt = triptime * 8;
|
||||
+ rts->rtt = ((uint64_t)triptime) * 8;
|
||||
else
|
||||
rts->rtt += triptime - rts->rtt / 8;
|
||||
if (rts->opt_adaptive)
|
||||
@@ -948,7 +948,7 @@ int finish(struct ping_rts *rts)
|
||||
int ipg = (1000000 * (long long)tv.tv_sec + tv.tv_nsec / 1000) / (rts->ntransmitted - 1);
|
||||
|
||||
printf(_("%sipg/ewma %d.%03d/%d.%03d ms"),
|
||||
- comma, ipg / 1000, ipg % 1000, rts->rtt / 8000, (rts->rtt / 8) % 1000);
|
||||
+ comma, ipg / 1000, ipg % 1000, (int)(rts->rtt / 8000), (int)((rts->rtt / 8) % 1000));
|
||||
}
|
||||
putchar('\n');
|
||||
return (!rts->nreceived || (rts->deadline && rts->nreceived < rts->npackets));
|
||||
@@ -973,7 +973,7 @@ void status(struct ping_rts *rts)
|
||||
fprintf(stderr, _(", min/avg/ewma/max = %ld.%03ld/%lu.%03ld/%d.%03d/%ld.%03ld ms"),
|
||||
(long)rts->tmin / 1000, (long)rts->tmin % 1000,
|
||||
tavg / 1000, tavg % 1000,
|
||||
- rts->rtt / 8000, (rts->rtt / 8) % 1000, (long)rts->tmax / 1000, (long)rts->tmax % 1000);
|
||||
+ (int)(rts->rtt / 8000), (int)((rts->rtt / 8) % 1000), (long)rts->tmax / 1000, (long)rts->tmax % 1000);
|
||||
}
|
||||
fprintf(stderr, "\n");
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
SUMMARY = "Network monitoring tools"
|
||||
DESCRIPTION = "Utilities for the IP protocol, including \
|
||||
tracepath, tracepath6, ping, ping6 and arping."
|
||||
HOMEPAGE = "https://github.com/iputils/iputils"
|
||||
SECTION = "console/network"
|
||||
|
||||
LICENSE = "BSD-3-Clause & GPL-2.0-or-later"
|
||||
|
||||
LIC_FILES_CHKSUM = "file://LICENSE;md5=627cc07ec86a45951d43e30658bbd819"
|
||||
|
||||
DEPENDS = "gnutls"
|
||||
|
||||
SRC_URI = "git://github.com/iputils/iputils;branch=master;protocol=https \
|
||||
file://CVE-2025-47268.patch \
|
||||
file://CVE-2025-48964.patch \
|
||||
"
|
||||
SRCREV = "8372f355bdf7a9b0c79338dd8ef8464c00a5c4e2"
|
||||
|
||||
S = "${WORKDIR}/git"
|
||||
|
||||
UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>20\d+)"
|
||||
|
||||
CVE_STATUS[CVE-2000-1213] = "fixed-version: Fixed in 2000-10-10, but the versioning of iputils breaks the version order."
|
||||
CVE_STATUS[CVE-2000-1214] = "fixed-version: Fixed in 2000-10-10, but the versioning of iputils breaks the version order."
|
||||
|
||||
PACKAGECONFIG ??= "libcap"
|
||||
PACKAGECONFIG[libcap] = "-DUSE_CAP=true, -DUSE_CAP=false -DNO_SETCAP_OR_SUID=true, libcap libcap-native"
|
||||
PACKAGECONFIG[libidn] = "-DUSE_IDN=true, -DUSE_IDN=false, libidn2"
|
||||
PACKAGECONFIG[gettext] = "-DUSE_GETTEXT=true, -DUSE_GETTEXT=false, gettext"
|
||||
PACKAGECONFIG[docs] = "-DBUILD_HTML_MANS=true -DBUILD_MANS=true,-DBUILD_HTML_MANS=false -DBUILD_MANS=false, libxslt"
|
||||
|
||||
inherit meson update-alternatives pkgconfig
|
||||
|
||||
EXTRA_OEMESON += "--prefix=${root_prefix}/ -DSKIP_TESTS=true"
|
||||
|
||||
ALTERNATIVE_PRIORITY = "100"
|
||||
|
||||
ALTERNATIVE:${PN}-ping = "ping"
|
||||
ALTERNATIVE_LINK_NAME[ping] = "${base_bindir}/ping"
|
||||
|
||||
ALTERNATIVE:${PN}-ping6 = "ping6"
|
||||
ALTERNATIVE_LINK_NAME[ping6] = "${base_bindir}/ping6"
|
||||
|
||||
SPLITPKGS = "${PN}-ping ${PN}-arping ${PN}-tracepath ${PN}-clockdiff \
|
||||
${@bb.utils.contains('DISTRO_FEATURES', 'ipv6', '${PN}-ping6', '', d)}"
|
||||
PACKAGES += "${SPLITPKGS}"
|
||||
|
||||
ALLOW_EMPTY:${PN} = "1"
|
||||
RDEPENDS:${PN} += "${SPLITPKGS}"
|
||||
|
||||
FILES:${PN} = ""
|
||||
FILES:${PN}-ping = "${base_bindir}/ping.${BPN}"
|
||||
FILES:${PN}-ping6 = "${base_bindir}/ping6.${BPN}"
|
||||
FILES:${PN}-arping = "${base_bindir}/arping"
|
||||
FILES:${PN}-tracepath = "${base_bindir}/tracepath"
|
||||
FILES:${PN}-clockdiff = "${base_bindir}/clockdiff"
|
||||
|
||||
do_install:append() {
|
||||
if ${@bb.utils.contains('DISTRO_FEATURES', 'ipv6', 'true', 'false', d)}; then
|
||||
ln -sf ping ${D}/${base_bindir}/ping6
|
||||
fi
|
||||
}
|
||||
Reference in New Issue
Block a user