REDHAT-BUG-2531353: Medium severity Busybox Busybox vulnerability
A vulnerability exists in the BusyBox passwd and group file parser in libpwdgrp/pwdgrp.c. The tokenize() function trims trailing whitespace via overlappingstrcpy() but continues to reference the stale end pointer, causing tokenizeend to be too large. This under-allocates in parsecommon(), and converttostruct() then writes grmem[] pointers past the end of the heap allocation.
Triggering the vulnerability requires injecting malformed entries with whitespace before commas into /etc/group, then invoking any applet that calls getgrnam().
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs a way to inject malformed entries containing whitespace before commas into /etc/group. The issue is triggered when an applet that calls getgrnam() subsequently processes that file.
Are systems using the default group-file contents affected?
The provided information identifies malformed /etc/group entries with whitespace before commas as a requirement. It does not indicate that ordinary default /etc/group contents alone trigger the vulnerability.
What can be done if an update cannot be applied immediately?
Prevent untrusted modification of /etc/group and inspect it for malformed entries with whitespace immediately before commas. Remove or correct such entries, and limit use of BusyBox applets that call getgrnam() until remediation is available.
How can I check whether a system may be exposed?
Review /etc/group for entries that contain whitespace before comma separators, especially if the file can be modified by less-trusted users or provisioning processes. Exposure also depends on whether BusyBox applets using getgrnam() are invoked after those entries are present.