REDHAT-BUG-2531355: Low severity BusyBox BusyBox vulnerability
A vulnerability exists in the BusyBox dpkg applet in archival/dpkg.c. The writestatusfile() function does not reset the fieldstart cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the stale cursor causes readpackagefield() to read past the second stanza's buffer.
Observable consequences include: silent data corruption (the second package stanza vanishes from the status file), potential heap information leakage, and crashes under ASan.
Affected Software
Event History
Frequently Asked Questions
When can this issue be triggered?
It can be triggered when the BusyBox dpkg applet removes two packages in one invocation and the first package's status stanza is larger than the second package's stanza.
What impact should operators expect?
The second package stanza can silently disappear from the status file. The flaw may also disclose heap information or cause crashes under ASan.
How can I check whether a system has been affected?
Review the dpkg status file after multi-package removals, particularly where the first removed package had a larger status stanza than the second. A missing status stanza for the second package is an observable indicator.