REDHAT-BUG-2531346: Medium severity Busybox Busybox vulnerability
A vulnerability was found in the BusyBox httpd IP-based access control list (ACL) parser (networking/httpd.c). When a D: (deny) rule is configured with a syntactically invalid CIDR prefix length, such as /999, the parser does not validate the mask value. Instead of rejecting the malformed rule or defaulting to a restrictive interpretation, the resulting miscalculated network mask silently fails to match the intended IP address range.
This means that a deny rule intended to block an entire subnet may effectively deny no traffic at all. The silent failure mode violates the principle of failing securely and could remain undetected for extended periods.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
BusyBox httpd deployments are exposed when they use an IP-based deny rule (D:) with a syntactically invalid CIDR prefix length, such as /999. Deployments without such malformed deny rules are not described as affected.
What would an attacker need to exploit the misconfiguration?
An attacker would need to connect from an IP address that administrators intended the malformed deny rule to block. Because the invalid prefix can cause the rule not to match the intended subnet, the connection may be allowed instead.
What can be done before a fix is available?
Review BusyBox httpd D: ACL entries and replace invalid CIDR prefix lengths with valid ones that correctly represent the intended network range. Confirm that the corrected deny rules block connections from addresses in the intended subnet.