CVE-2025-47268

What it actually does

A crafted ICMP Echo Reply packet triggers a signed 64-bit integer overflow during timestamp multiplication in the ping utility, resulting in application error or incorrect data collection.

Why it matters to the business

Network diagnostic and monitoring tools may crash or produce unreliable results, disrupting routine connectivity checks and potentially affecting dependent operational processes across many environments.

How an attack unfolds

An attacker sends a specially crafted ICMP Echo Reply packet to a system running vulnerable ping; the packet is processed, the overflow occurs in timestamp handling, and the utility either terminates with an error or returns corrupted data.

How to fix it

Upgrade iputils to version 20250602 or later; for source builds apply commit 070cfacd7348386173231fb16fad4983d4e6ae40; Android devices should use SoCVersion 2022-06-05 or newer where applicable.

How to confirm the fix worked

Verify the installed iputils version is at or above the fixed release; test by sending a known-triggering ICMP Echo Reply and confirm the utility no longer crashes or produces invalid output.

Typical attack path

1. Identify hosts running vulnerable iputils ping versions
2. Craft an ICMP Echo Reply packet that triggers the timestamp multiplication overflow
3. Transmit the packet to the target ping process
4. Observe application error or incorrect data collection on the target

How to detect it

Review system and application logs for unexpected ping process terminations or error messages related to ICMP reply processing; correlate with network traffic containing unusual ICMP Echo Reply packets.

What your security team should do

• Apply the fixed iputils version or commit immediately on all affected systems
• Inventory environments using iputils to confirm exposure
• Monitor for any downstream package updates that incorporate the fix