CVE-2025-48964: iputils ping DoS Vulnerability

CVE-2025-48964 Overview

CVE-2025-48964 is an integer overflow vulnerability in the ping utility within iputils versions before 20250602. The vulnerability allows remote attackers to cause a denial of service through crafted ICMP Echo Reply packets. When a zero timestamp is present in the ICMP payload, it can lead to large intermediate values that overflow when squared during statistics calculations, resulting in application errors in adaptive ping mode or incorrect data collection.

This vulnerability exists as an incomplete fix for CVE-2025-47268, which only addressed timestamp calculations without accounting for the specific scenario where the original timestamp in the ICMP payload is zero.

Critical Impact

Remote attackers can disrupt network diagnostic operations by sending specially crafted ICMP packets that trigger integer overflow conditions, potentially affecting network monitoring and troubleshooting capabilities.

Affected Products

• iputils versions before 20250602
• Linux distributions shipping vulnerable iputils packages
• Systems using the ping utility with adaptive ping mode enabled

Discovery Timeline

• 2025-07-22 - CVE-2025-48964 published to NVD
• 2025-08-26 - Last updated in NVD database

Technical Details for CVE-2025-48964

Vulnerability Analysis

The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound). The flaw resides in the statistics calculation routines of the ping utility when processing ICMP Echo Reply packets. Under normal operation, ping calculates round-trip time statistics by comparing timestamps embedded in ICMP payloads. However, when an attacker crafts an ICMP Echo Reply packet containing a zero timestamp, the subsequent calculations produce unexpectedly large intermediate values.

The core issue manifests during the squaring operation performed for variance and standard deviation calculations. When these large intermediate values are squared, they exceed the maximum value representable by the integer type, causing an overflow. This overflow corrupts the statistical calculations, leading to either application crashes in adaptive ping mode or silently incorrect data collection in standard mode.

This vulnerability is particularly notable because it represents a bypass of the previous fix for CVE-2025-47268. The earlier patch addressed timestamp calculation issues but failed to account for the edge case where the original timestamp value is explicitly zero, creating a gap that attackers can exploit.

Root Cause

The root cause is an incomplete input validation check in the timestamp processing logic. When an ICMP Echo Reply contains a zero timestamp, the calculation logic produces large intermediate values that were not anticipated by the developers. The squaring operation during statistics computation then causes these values to overflow the integer bounds, corrupting memory or calculation state.

The fix implemented in version 20250602 adds proper bounds checking and handling for the zero timestamp scenario, ensuring that intermediate values cannot grow large enough to cause overflow when squared.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft malicious ICMP Echo Reply packets with zero timestamps and send them to a target system running a vulnerable version of ping. The attack is particularly effective against:

• Network monitoring systems using continuous ping operations
• Automated health check scripts utilizing adaptive ping mode
• Network troubleshooting sessions where administrators rely on ping statistics

The attack does not require the attacker to be in a privileged network position, though they must be able to send ICMP packets to the target system. The vulnerability affects both the integrity of collected data and the availability of the ping utility itself.

Detection Methods for CVE-2025-48964

Indicators of Compromise

• Unexpected crashes or errors from the ping utility during normal network operations
• Anomalous ICMP Echo Reply packets with zero or malformed timestamp fields
• Statistical output from ping showing impossibly large or negative values
• Application core dumps associated with the ping process

Detection Strategies

• Monitor for ICMP Echo Reply packets containing zero timestamps in the payload
• Implement network intrusion detection rules to flag malformed ICMP packets
• Set up process monitoring to detect repeated ping utility crashes or abnormal terminations
• Review system logs for segmentation faults or arithmetic errors from iputils components

Monitoring Recommendations

• Enable verbose logging for network diagnostic utilities when troubleshooting connectivity issues
• Configure network monitoring tools to alert on unusual ICMP traffic patterns
• Implement rate limiting for ICMP traffic to reduce the impact of potential exploitation attempts
• Regularly audit iputils package versions across managed systems

How to Mitigate CVE-2025-48964

Immediate Actions Required

• Upgrade iputils to version 20250602 or later immediately
• Review network monitoring scripts and disable adaptive ping mode as a temporary workaround if upgrading is not immediately possible
• Audit systems for vulnerable iputils installations using package management tools
• Consider implementing ICMP filtering at network boundaries for untrusted traffic

Patch Information

The vulnerability has been addressed in iputils version 20250602. The fix is available in the GitHub commit afa36390394a6e0cceba03b52b59b6d41710608c. System administrators should update their iputils packages through their distribution's package manager or compile from source using the latest release.

For detailed information about the vulnerability and fix, refer to the GitHub Security Advisory GHSA-25fr-jw29-74f9 and the SUSE Bug Report #1243772.

Workarounds

• Avoid using adaptive ping mode (-A flag) until the system is patched
• Implement firewall rules to filter suspicious ICMP traffic from untrusted sources
• Use alternative network diagnostic tools that are not affected by this vulnerability
• Restrict ping utility access to privileged users only through system permissions

# Update iputils on Debian/Ubuntu systems
sudo apt update && sudo apt install --only-upgrade iputils-ping

# Update iputils on RHEL/CentOS/Fedora systems
sudo dnf update iputils

# Verify installed version
ping -V