BusyBox vulnerabilities

This CVE candidate has been rejected by Red Hat Product Security because it is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATURE_WGET_HTTPS that it does not verify peer identity or provide full TLS security; missing Finished verify_data checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.

In netstat in BusyBox through 1.37.0, local users can launch a network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

A use-after-free vulnerability exists in BusyBox v1.36.1 in the evaluate function in awk.c. An attacker can cause a denial of service via a crafted awk pattern.

A use-after-free vulnerability was discovered in the xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature does not sanitize filenames, potentially leading to executing any escape sequences in the terminal.

Directory traversal vulnerability in the BusyBox implementation of tar before version 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.

Integer overflow in the DHCP client (udhcpc) in BusyBox before version 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, leading to an out-of-bounds heap write.

The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service via a forged NTP packet, triggering a communication loop.

The vulnerability in BusyBox affects the write_status_file() function in the dpkg tool. Failure to reset a stale field cursor between package stanzas leads to out-of-bounds reads and corruption of the status file when removing multiple packages.

BLU-IC2 and BLU-IC4 devices include a vulnerable version of BusyBox 1.31.1 with multiple known security vulnerabilities. The issue affects versions through 1.19.5.

A stack overflow vulnerability exists in ash.c:6030 in busybox before version 1.35. In the Internet of Vehicles environment, it can be exploited from command execution to arbitrary code execution.

BusyBox libarchive contains a symlink directory traversal vulnerability allowing remote attackers to create arbitrary files. User interaction is required: the target must visit a malicious page or open a malicious file. The flaw results from lack of proper validation of a user-supplied path before use in file operations.

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can cause a file to be written outside the intended extraction directory.

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy forwards requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. A pipelined second request is relayed verbatim to the backend, bypassing the configured path restrictions.

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it.

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. This can result in an out-of-bounds read.

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. This can lead to memory corruption.

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check. This may allow unauthorized access.

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. This may lead to data disclosure or a crash.

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. This may result in failure to block unwanted addresses.

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

A vulnerability was found in BusyBox up to version 1.30.1 in the file networking/wget.c, in the FEATURE_WGET_TIMEOUT Handler component. Manipulation of the -T argument leads to a null pointer dereference. Local access is required. The exploit has been disclosed, and a patch is available (commit 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff).

A heap overflow in the evalcommand() function (shell/ash.c) of BusyBox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0. An attacker can cause a Denial of Service (DoS) by supplying crafted input.

A stack overflow vulnerability exists in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9. Attackers can cause a Denial of Service (DoS) by supplying a crafted AWK script.

A use-after-free vulnerability in the awk_sub() function (editors/awk.c) of BusyBox v1.38.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted AWK script.

BusyBox before commit 42202bf has a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler. A network-adjacent attacker can send a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option to trigger memory corruption.

A flaw was found in BusyBox allowing an attacker to modify files outside the intended extraction directory via a crafted tar archive with unvalidated hardlink or symlink entries. Extraction with elevated privileges can lead to privilege escalation.

A flaw was found in BusyBox where incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that, when extracted under specific conditions, may write to files outside the intended directory.

Busybox 1.31.1 contains multiple known vulnerabilities. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.

A vulnerability in the CPIO command of Busybox v1.33.2 allows attackers to perform a directory traversal. The issue stems from improper handling of file paths when extracting CPIO archives.

A use-after-free vulnerability exists in BusyBox 1.35-x's awk applet within the copyvar function. Processing a crafted awk pattern can lead to denial of service or potentially code execution.