Rejected reason: Red Hat Product Security determined this is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATUREWGETHTTPS that it does not verify peer identity or provide full TLS security; missing Finished verifydata checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.

A flaw was found in busybox. The tar applet defers creation of symlink and hardlink entries whose targets look unsafe (absolute paths, hardlinks, or targets containing '..') until after all archive members have been processed, in order to avoid a same-archive time-of-check-to-time-of-use issue. However, when those deferred links are finally created, the code performs the underlying symlink() or link() system call directly, without re-validating that the resolved destination parent remains inside the extraction directory. By chaining an immediately-created symlink with a deferred symlink whose target is exactly '..' (a value not caught by the separate prefix-based sanitizer applied to member names, which only strips leading '../' and embedded '/../' sequences), an attacker can make a path that appears to be inside the extraction directory resolve outside it once the deferred link is created. Combined with a deferred hardlink in the same archive, this creates a new file outside the extraction directory; reusing the same destination directory across two archives allows an existing external file to be deleted and replaced with attacker-controlled content, including attacker-controlled ownership and permissions for privileged extraction, since the second archive's replacement member is an ordinary file entry (not a hardlink) and is subject to busybox tar's normal chown()/chmod() restoration from the archive header. The one-archive hardlink primitive requires the internal source file and the external target to reside on the same filesystem; the two-archive primitive requires the extraction directory to be reused across two extraction invocations.

A flaw was found in busybox. The tar applet defers creation of symlink and hardlink entries whose targets look unsafe (absolute paths, hardlinks, or targets containing '..') until after all archive members have been processed, in order to avoid a same-archive time-of-check-to-time-of-use issue. However, when those deferred links are finally created, the code performs the underlying symlink() or link() system call directly, without re-validating that the resolved destination parent remains inside the extraction directory. By chaining an immediately-created symlink with a deferred symlink whose target is exactly '..' (a value not caught by the separate prefix-based sanitizer applied to member names, which only strips leading '../' and embedded '/../' sequences), an attacker can make a path that appears to be inside the extraction directory resolve outside it once the deferred link is created. Combined with a deferred hardlink in the same archive, this creates a new file outside the extraction directory; reusing the same destination directory across two archives allows an existing external file to be deleted and replaced with attacker-controlled content, including attacker-controlled ownership and permissions for privileged extraction, since the second archive's replacement member is an ordinary file entry (not a hardlink) and is subject to busybox tar's normal chown()/chmod() restoration from the archive header. The one-archive hardlink primitive requires the internal source file and the external target to reside on the same filesystem; the two-archive primitive requires the extraction directory to be reused across two extraction invocations.

This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user.

This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user.

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.

BusyBox provides lightweight Unix utilities as a single binary. A path traversal vulnerability exists in the dpkg-deb extraction path in archival/libarchive/getheaderar.c. The ar container handler flushes deferred symlinks (via createlinksfromlist() at line 133) inside the per-member loop, rather than once after all members are processed. The tar, cpio, and unzip front-ends correctly flush deferred symlinks after the main loop (tar.c:1269, cpio.c:578, unzip.c:1059), but the ar path does not follow this pattern.

The deferred-symlink mechanism (unsafesymlinktarget.c:13) exists to prevent directory traversal: symlinks with absolute targets or '..' components are deferred until after all archive members are extracted, so that no subsequent member can traverse them. By flushing per ar member, the ar path breaks this invariant: a symlink deferred from the first data.tar member is placed on disk before the second data.tar member is parsed.

A crafted .deb containing two uncompressed data.tar ar members can exploit this: the first declares a symlink whose target is the filesystem root, and the second declares a regular file whose path is resolved through that live symlink, writing a file outside the extraction root.

Constraints: only uncompressed data.tar members work (compressed members cause setupunziponfd() to replace srcfd with a pipe, making the subsequent lseek fail). filteracceptlistreassign() does not remove matched entries from the accept list, so duplicate member names are accepted. BBSUIDDROP is set for the dpkg-deb applet, preventing setuid escalation.

The reporter states the bug was introduced by commit 8c24af9dc (2018-05-22), affecting versions 1290 through current master. No fixing commit exists. Reproduced on Fedora busybox-1.37.0-7.fc44, Debian 13, and Ubuntu 24.04 LTS.

Reported by Shubham Raj, Causal Security. PSIRT ticket: PSIRTSUPT-23314.

A flaw was found in BusyBox dpkg. The writestatusfile() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

A vulnerability exists in the BusyBox dpkg applet in archival/dpkg.c. The writestatusfile() function does not reset the fieldstart cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the stale cursor causes readpackagefield() to read past the second stanza's buffer.

Observable consequences include: silent data corruption (the second package stanza vanishes from the status file), potential heap information leakage, and crashes under ASan.

A vulnerability exists in the BusyBox TLS server implementation in networking/tls.c. The getclienthello() function reads p[0] (the compression-methods length byte) after consuming the cipher suite list without verifying that len > 0. A crafted ClientHello that ends immediately after the cipher suite list triggers a 1-byte out-of-bounds heap read.

This is a pre-authentication vulnerability. The one-byte OOB read can potentially leak a single byte of adjacent heap memory or cause a crash in memory-safety-hardened builds.

A vulnerability exists in the BusyBox TLS server implementation in networking/tls.c. The getclienthello() function reads p[0] (the compression-methods length byte) after consuming the cipher suite list without verifying that len > 0. A crafted ClientHello that ends immediately after the cipher suite list triggers a 1-byte out-of-bounds heap read.

This is a pre-authentication vulnerability. The one-byte OOB read can potentially leak a single byte of adjacent heap memory or cause a crash in memory-safety-hardened builds.

A vulnerability exists in the BusyBox passwd and group file parser in libpwdgrp/pwdgrp.c. The tokenize() function trims trailing whitespace via overlappingstrcpy() but continues to reference the stale end pointer, causing tokenizeend to be too large. This under-allocates in parsecommon(), and converttostruct() then writes grmem[] pointers past the end of the heap allocation.

Triggering the vulnerability requires injecting malformed entries with whitespace before commas into /etc/group, then invoking any applet that calls getgrnam().

A vulnerability exists in the BusyBox httpd applet's Basic Authentication password verification logic in networking/httpd.c. The code uses if (passwd[0] == '$' && isdigit(passwd[1])) to distinguish hashed passwords from plaintext. Yescrypt hashes begin with $y$, and because 'y' does not satisfy isdigit(), the detection logic fails. The code falls through to the plaintext strcmp branch, making the stored hash string itself the "password."

Supplying the literal hash string as the password results in HTTP 200, while the actual plaintext password is rejected with HTTP 401. Exploitation requires the attacker to first obtain the hash string from httpd.conf.

A vulnerability exists in the BusyBox httpd applet's Basic Authentication password verification logic in networking/httpd.c. The code uses if (passwd[0] == '$' && isdigit(passwd[1])) to distinguish hashed passwords from plaintext. Yescrypt hashes begin with $y$, and because 'y' does not satisfy isdigit(), the detection logic fails. The code falls through to the plaintext strcmp branch, making the stored hash string itself the "password."

Supplying the literal hash string as the password results in HTTP 200, while the actual plaintext password is rejected with HTTP 401. Exploitation requires the attacker to first obtain the hash string from httpd.conf.

A vulnerability exists in the BusyBox passwd and group file parser in libpwdgrp/pwdgrp.c. The tokenize() function trims trailing whitespace via overlappingstrcpy() but continues to reference the stale end pointer, causing tokenizeend to be too large. This under-allocates in parsecommon(), and converttostruct() then writes grmem[] pointers past the end of the heap allocation.

Triggering the vulnerability requires injecting malformed entries with whitespace before commas into /etc/group, then invoking any applet that calls getgrnam().

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

A vulnerability exists in the BusyBox mount applet's non-root option filter in util-linux/mount.c. The filter uses cmdoptflags & ~MSSILENT to test for dangerous options, but clearing-mask options (suid, dev, exec) AND bits off rather than OR bits on, evaluating to zero and passing the check unconditionally. This allows a non-root user to strip nosuid, nodev, and noexec restrictions from fstab-defined user mounts.

The finding was reproduced only after artificially setting the setuid bit on BusyBox. Only the filter bypass was demonstrated, not actual privilege escalation.

A vulnerability was found in the BusyBox dpkg implementation (archival/dpkg.c). The restart path in readpackagefield() incorrectly handles the case where a field has a name but an empty value followed by a NUL terminator, stepping one byte past the buffer and reading adjacent heap memory. This causes a bus error or segfault.

A vulnerability was found in the BusyBox dpkg implementation (archival/dpkg.c). The restart path in readpackagefield() incorrectly handles the case where a field has a name but an empty value followed by a NUL terminator, stepping one byte past the buffer and reading adjacent heap memory. This causes a bus error or segfault.

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

A vulnerability was found in the BusyBox httpd Basic Authentication handler (networking/httpd.c) when configured to authenticate against system passwords. A missing else clause after a failed getspnamr() call creates an observable behavioral difference between authentication failures for existing and non-existing system users. Existing user with wrong password: connection reset. Non-existing user: clean HTTP 401.

A vulnerability was found in the BusyBox DHCP client (networking/udhcp/dhcpc.c), specifically in d4recvrawpacket(). The function trusts the attacker-controlled IP totlen field to calculate the payload size. When a malicious DHCP packet is sent with IP totlen set to 20, the subtraction underflows to a negative value, wraps to a massive unsigned value, and is passed to memcpy(), causing an immediate segfault.

Remote code execution is not practical because the oversized memcpy faults immediately. The attack requires Layer 2 network adjacency.

A vulnerability was found in the BusyBox romfs filesystem volume identification module (util-linux/volumeid/romfs.c). When parsing a romfs superblock, the code calls strlen() on attacker-controlled volume name metadata without any bounds checking. The resulting length is passed to memcpy() via volumeidsetlabelstring(), which copies the data into a fixed-size label field of approximately 65 bytes.

A crafted romfs filesystem image can contain a volume name of up to approximately 4080 bytes. When such an image is processed by blkid or findfs, the unbounded memcpy() writes far beyond the label buffer boundary, corrupting adjacent heap memory.

A vulnerability was found in the BusyBox romfs filesystem volume identification module (util-linux/volumeid/romfs.c). When parsing a romfs superblock, the code calls strlen() on attacker-controlled volume name metadata without any bounds checking. The resulting length is passed to memcpy() via volumeidsetlabelstring(), which copies the data into a fixed-size label field of approximately 65 bytes.

A crafted romfs filesystem image can contain a volume name of up to approximately 4080 bytes. When such an image is processed by blkid or findfs, the unbounded memcpy() writes far beyond the label buffer boundary, corrupting adjacent heap memory.

A vulnerability was found in the BusyBox httpd IP-based access control list (ACL) parser (networking/httpd.c). When a D: (deny) rule is configured with a syntactically invalid CIDR prefix length, such as /999, the parser does not validate the mask value. Instead of rejecting the malformed rule or defaulting to a restrictive interpretation, the resulting miscalculated network mask silently fails to match the intended IP address range.

This means that a deny rule intended to block an entire subnet may effectively deny no traffic at all. The silent failure mode violates the principle of failing securely and could remain undetected for extended periods.

A vulnerability was found in the BusyBox httpd IP-based access control list (ACL) parser (networking/httpd.c). When a D: (deny) rule is configured with a syntactically invalid CIDR prefix length, such as /999, the parser does not validate the mask value. Instead of rejecting the malformed rule or defaulting to a restrictive interpretation, the resulting miscalculated network mask silently fails to match the intended IP address range.

This means that a deny rule intended to block an entire subnet may effectively deny no traffic at all. The silent failure mode violates the principle of failing securely and could remain undetected for extended periods.

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

A vulnerability was found in the BusyBox TLS implementation (networking/tlspstmmontgomeryreduce.c). A unit confusion error exists in the buffer allocation for the Montgomery reduction operation. The code calls xzalloc(2pa+1) where pa is measured in pstmdigit units (4 or 8 bytes each), but the allocation treats this value as a byte count. This results in an allocation approximately 4x to 8x smaller than required.

When a TLS client sends a crafted ClientKeyExchange message with an all-zeros payload, the RSA decryption path triggers the Montgomery reduction, which writes digit-sized elements beyond the allocated buffer boundary. This constitutes a pre-authentication out-of-bounds heap write.

The confirmed impact is a pre-authentication denial of service (crash). While the heap buffer overflow is theoretically exploitable for remote code execution, this was not demonstrated. On Fedora, system-level mitigations including ASLR, PIE, full RELRO, and SELinux confinement make practical code execution extremely unlikely.