CVE-2025-47268
📋 TL;DR
A signed 64-bit integer overflow vulnerability in iputils ping allows denial of service through crafted ICMP Echo Reply packets. This can cause ping to crash or collect incorrect round-trip time data. Systems using iputils ping versions before 20250602 are affected.
💻 Affected Systems
- iputils ping
📦 What is this software?
Iputils by Iputils Project
⚠️ Risk & Real-World Impact
Worst Case
ping process crashes, disrupting network diagnostics and monitoring tools that rely on ping functionality
Likely Case
ping crashes when processing malicious ICMP replies, causing temporary loss of ping functionality
If Mitigated
Minimal impact if ping is not critical for operations or if alternative network tools are available
🎯 Exploit Status
Proof-of-concept code is publicly available on GitHub. Exploitation requires sending crafted ICMP packets to a system running ping.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iputils 20250602 and later
Vendor Advisory: https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40
Restart Required: No
Instructions:
1. Update iputils package to version 20250602 or later. 2. For Linux distributions: Use package manager (apt, yum, dnf, etc.) to update iputils. 3. For source installations: Pull latest commit from GitHub repository.
🔧 Temporary Workarounds
Block ICMP Echo Reply packets
linuxUse firewall rules to block incoming ICMP Echo Reply packets
iptables -A INPUT -p icmp --icmp-type echo-reply -j DROP
Use alternative ping implementations
linuxReplace iputils ping with alternative implementations like busybox ping or nping
apt-get install busybox
yum install nmap-ncat
🧯 If You Can't Patch
- Restrict ping usage to trusted networks only
- Monitor for ping process crashes and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check iputils version: ping -V 2>&1 | grep iputilsCheck Version:
ping -V 2>&1 | head -1Verify Fix Applied:
Verify version is 20250602 or later: ping -V 2>&1 | grep -E 'iputils.*20250602|version.*20250602'📡 Detection & Monitoring
Log Indicators:
- ping process crashes in system logs
- unexpected ping termination messages
Network Indicators:
- Unusual ICMP Echo Reply packets with crafted timestamps
SIEM Query:
process:ping AND (event:crash OR event:terminated)🔗 References
- https://bugzilla.suse.com/show_bug.cgi?id=1242300
- https://github.com/Zephkek/ping-rtt-overflow/
- https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40
- https://github.com/iputils/iputils/issues/584
- https://github.com/iputils/iputils/pull/585
- https://github.com/iputils/iputils/releases/tag/20250602
- https://github.com/Zephkek/ping-rtt-overflow/
