Critical Out of Bounds Read Vulnerability in BusyBox - CVE-2019-5747
Summary
ALPINE-CVE-2019-5747: An issue was discovered in BusyBox through 1.30.0. Affects busybox versions < 1.30.1-r2. Fixed in 1.30.1-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BusyBox is a software suite that provides several Unix utilities in a single executable file. It is widely used in embedded systems and Linux distributions due to its lightweight nature and versatility. The package combines tiny versions of many common UNIX utilities into a single small executable, making it ideal for resource-constrained environments. However, it has been found to have a critical vulnerability that could allow remote attackers to exploit it.
Vulnerability Detail
An issue was discovered in BusyBox through version 1.30.0, specifically in the udhcp components, which are utilized by the DHCP client, server, and relay. The vulnerability arises from an out of bounds read that could allow a remote attacker to leak sensitive information from the stack by sending a specially crafted DHCP message. This issue is linked to an incomplete fix for CVE-2018-20679, and it poses a significant risk as it can lead to unauthorized access to sensitive data. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.30.1-r2
This is the first release that contains the fix.
sudo apk add --upgrade busyboxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider disabling the DHCP service temporarily until the patch can be applied. This can be done by stopping the service with the command: 'service udhcpd stop'. However, this is not a permanent solution and should only be used as a temporary measure.
Conclusion
The BusyBox vulnerability CVE-2019-5747 poses a significant risk due to its potential to leak sensitive information through crafted DHCP messages. It is crucial to update to the patched version to mitigate this risk. Users should also consider temporary workarounds if immediate updates are not feasible.
See every vulnerability recorded for busybox →
FAQ
CVE-2019-5747 is a vulnerability in BusyBox that allows for an out of bounds read, potentially leaking sensitive information via crafted DHCP messages.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive information, which can be exploited by attackers for malicious purposes.
Yes, the patched version of BusyBox is 1.30.1-r2 for Alpine v3.10 and later. It is recommended to update to this version.
If an immediate update is not possible, consider disabling the DHCP service temporarily as a workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for busybox.
