From 2715339ec69ffd43ab26ef377fe2cdce2d3d5b20 Mon Sep 17 00:00:00 2001 From: Petr Vorel Date: Mon, 21 Apr 2025 22:31:07 +0200 Subject: [PATCH] package/iproute2: backport NULL dereference fix This will be part of 6.15.0 release. Signed-off-by: Petr Vorel [Julien: fix check-package error by adding "Upstream:" tag in patch] Signed-off-by: Julien Olivain (cherry picked from commit 6bcefa73b1aeefcca81fd4ca2e33f5bf1d3ce9e3) Signed-off-by: Thomas Perale --- ...ereference-when-no-entries-specified.patch | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 package/iproute2/0001-nstat-NULL-Dereference-when-no-entries-specified.patch diff --git a/package/iproute2/0001-nstat-NULL-Dereference-when-no-entries-specified.patch b/package/iproute2/0001-nstat-NULL-Dereference-when-no-entries-specified.patch new file mode 100644 index 0000000000..9b5e727fe3 --- /dev/null +++ b/package/iproute2/0001-nstat-NULL-Dereference-when-no-entries-specified.patch @@ -0,0 +1,36 @@ +From 866e1d107b7de68ca1fcd1d4d5ffecf9d96bff30 Mon Sep 17 00:00:00 2001 +From: ZiAo Li <23110240084@m.fudan.edu.cn> +Date: Wed, 9 Apr 2025 23:03:30 +0800 +Subject: [PATCH] nstat: NULL Dereference when no entries specified + +The NULL Pointer Dereference vulnerability happens in load_ugly_table(), misc/nstat.c, in the latest version of iproute2. +The vulnerability can be triggered by: +1. db is set to NULL at struct nstat_ent *db = NULL; +2. n is set to NULL at n = db; +3. NULL dereference of variable n happens at sscanf(p+1, "%llu", &n->val) != 1 + +Signed-off-by: ZiAo Li <23110240084@m.fudan.edu.cn> +Signed-off-by: Stephen Hemminger +Upstream: https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=866e1d107b7de68ca1fcd1d4d5ffecf9d96bff30 +--- + misc/nstat.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/misc/nstat.c b/misc/nstat.c +index fce3e9c1..b2e19bde 100644 +--- a/misc/nstat.c ++++ b/misc/nstat.c +@@ -218,6 +218,10 @@ static void load_ugly_table(FILE *fp) + p = next; + } + n = db; ++ if (n == NULL) { ++ fprintf(stderr, "Error: Invalid input – line has ':' but no entries. Add values after ':'.\n"); ++ exit(-2); ++ } + nread = getline(&buf, &buflen, fp); + if (nread == -1) { + fprintf(stderr, "%s:%d: error parsing history file\n", +-- +2.49.0 +