REDHAT-BUG-2571675: Medium severity vulnerability
A flaw was found in BusyBox's volumeid. In volumeidgetbuffer(), a 64-bit offset+length addition can wrap past 2^64, passing the buffer size check and returning a pointer far outside the buffer, which the NTFS prober dereferences, causing a SIGSEGV crash. A crafted filesystem image on an attached device triggers this when probed by blkid, findfs or mount LABEL=/UUID=, preventing those applets from resolving any device.
Affected Software
Event History
Frequently Asked Questions
Which BusyBox operations can trigger the crash?
The crafted filesystem image is triggered when it is probed by blkid, findfs, or mount using LABEL= or UUID= resolution.
What does an attacker need to exploit this issue?
An attacker needs a crafted filesystem image on an attached device that will be probed by the affected BusyBox volume identification code.
What is the operational impact of successful exploitation?
The NTFS prober can dereference a pointer outside its buffer and crash with SIGSEGV. This prevents the affected applets from resolving any device.