CVE-2025-48964

What it actually does

A crafted ICMP Echo Reply packet with a zero timestamp in the payload triggers large intermediate values that overflow when squared during statistics calculations in adaptive ping mode, resulting in application error or incorrect data collection.

Why it matters to the business

Disrupts network diagnostic and troubleshooting capabilities, potentially delaying operational monitoring or incident response in environments relying on the ping utility.

How an attack unfolds

An attacker sends a malicious ICMP Echo Reply packet containing a zero timestamp to a target system running ping in adaptive mode, exploiting the incomplete timestamp handling to induce an integer overflow.

How to fix it

Upgrade iputils to commit 23b06385444fba29c898370ae6f297e41c11667b or any release after 20250602 that fully addresses the timestamp scenario.

How to confirm the fix worked

Confirm the installed iputils version includes the referenced commit; perform functional testing with simulated zero-timestamp ICMP replies to verify absence of overflow behavior.

Typical attack path

1. Identify a target system executing ping in adaptive mode
2. Craft an ICMP Echo Reply packet with a zero timestamp value in the payload
3. Transmit the packet to the running ping process
4. Trigger integer overflow during squared timestamp calculations leading to error or crash

How to detect it

Inspect system and application logs for ping crashes or errors mentioning adaptive mode or timestamp calculations; correlate with incoming ICMP traffic containing unusual payload values.

What your security team should do

• Prioritize upgrade of iputils across all affected systems
• Review network monitoring for anomalous ICMP Echo Reply traffic targeting diagnostic tools
• Temporarily avoid adaptive ping mode in untrusted environments until patched