CVE-2024-58251: Low severity BusyBox netstat vulnerability
In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/busyboxto a version that resolves this vulnerability.Fixed in 1.36.1-r21 - Upgrade
Upgrade
alpine/busyboxto a version that resolves this vulnerability.Fixed in 1.36.1-r31 - Upgrade
Upgrade
alpine/busyboxto a version that resolves this vulnerability.Fixed in 1.37.0-r14 - Upgrade
Upgrade
alpine/busyboxto a version that resolves this vulnerability.Fixed in 1.37.0-r20 - Upgrade
Upgrade
alpine/busyboxto a version that resolves this vulnerability.Fixed in 1.37.0-r24 - Upgrade
Upgrade
debian/busyboxto a version that resolves this vulnerability.Fixed in 1:1.37.0-9 - Upgrade
Upgrade
debian/busyboxto a version that resolves this vulnerability.Fixed in 1:1.38.0-3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58251?
CVE-2024-58251 has a moderate severity level as it can cause denial of service leading to terminal lockup.
How do I fix CVE-2024-58251?
To fix CVE-2024-58251, upgrade BusyBox to version 1.37.0 or later.
What is the impact of CVE-2024-58251?
The impact of CVE-2024-58251 is that local users can disrupt network application usage by causing terminal lockups.
Who is affected by CVE-2024-58251?
CVE-2024-58251 affects users of BusyBox's netstat version 1.37.0 and earlier.
Can CVE-2024-58251 be exploited remotely?
No, CVE-2024-58251 requires local access to exploit the vulnerability.