Dear Maintainer,
AX25_print() in lib/ax25.c and NETROM_print() in lib/netrom.c format a
callsign into "static char buff[8]". An AX.25 callsign is up to six
characters plus an SSID from 0 to 15, so the longest form, for example
F6BVP-12 or N0CALL-15, needs 9 or 10 bytes with the terminating NUL. Any
callsign of five or six letters with a two-digit SSID overflows the
buffer by one or two bytes.
It is hit simply by running ifconfig (or netstat, route, arp) on a host
with an AX.25 or NET/ROM interface configured with such a callsign:
ax0: flags=67<UP,BROADCAST,RUNNING> mtu 253
ax25 F6BVP-10 txqueuelen 10 (AMPR AX.25)
With the hardening flags of the current Ubuntu build
(_FORTIFY_SOURCE=3), ifconfig aborts:
$ ifconfig ax0
*** buffer overflow detected ***: terminated
With the Debian builds (checked on 2.10-1.3 armhf and arm64,
2.10-0.1+deb12u2 arm64 and i386, 1.60+git20181103.0eebece-1+deb11u2
armhf) the output looks right but one or two bytes past the end of the
static buffer are silently overwritten.
The bug is present in every version I looked at: 1.60+git20180626,
1.60+git20181103, 2.10, and still in 2.10-2 in sid.
It is fixed upstream:
c084d1fea5de "Prevent overflow in ax25 and netrom"
139f5d8 "Fix sprintf that should be snprintf" (c084d1f used
sprintf() with a size argument, which does not build)
https://www.google.com/url?q=https://github.com/ecki/net-tools/commit/c084d1fea5de0f6dcaed4a59b38a4140bd2e9f13&source=gmail&ust=1792170184332000&sa=E
The attached patch combines both commits in a form ready for
debian/patches (DEP-3 header). It applies on top of the existing series
of 2.10-2, 2.10-1.3, 2.10-0.1+deb12u2 and 1.60+git20181103.0eebece-1+deb11u2
without change. I rebuilt the package with it on eight amateur radio
nodes (Debian 11, 12 and 13, Raspberry Pi OS, Ubuntu 20.04, 24.04 and
26.04; amd64, i386, armhf and arm64); ifconfig, netstat and route display
the AX.25, NET/ROM and ROSE interfaces correctly and the Ubuntu abort is
gone.
As the fix is small and the code is reachable on every host running an
AX.25 node, it may also be worth considering for trixie and bookworm
through a stable update.
Thanks,
Bernard Pidoux, F6BVP