REDHAT-BUG-2571607: High severity BusyBox BusyBox vulnerability
A flaw was found in BusyBox's tftp client. When the server's first reply to a read or write request is not an OACK packet, the client falls back to the default block size of 512 bytes without reallocating the packet buffers, which were allocated for the smaller block size requested with the -b option. A malicious tftp server can exploit this by sending a 516-byte datagram that is stored into the undersized heap buffer; on upload, 512 bytes of the local file are read into the undersized buffer. Processing a crafted tftp transfer may cause the client to crash or potentially execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The BusyBox tftp client must make a read or write request using the -b option with a block size smaller than 512 bytes. The TFTP server must then send a first response that is not an OACK packet, causing the client to fall back to 512-byte blocks without resizing its buffers.
Does an attacker need to control the TFTP server?
Yes. Exploitation requires a malicious TFTP server that can control the initial reply and send a crafted transfer datagram.
Are both TFTP downloads and uploads affected?
Yes. On downloads, a 516-byte datagram can be written to the undersized heap buffer. On uploads, the client can read 512 bytes from the local file into that undersized buffer.