Critical Remote Code Execution Vulnerability in BusyBox
Summary
ALPINE-CVE-2022-28391: BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Affects busybox versions < 1.31.1-r22. Fixed in 1.31.1-r22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BusyBox is a software suite that provides several Unix utilities in a single executable file. It is widely used in embedded systems and Linux distributions due to its lightweight nature and versatility. However, certain versions of BusyBox are vulnerable to a remote code execution flaw that can be exploited through the netstat command when printing DNS PTR records to a terminal.
Vulnerability Detail
The vulnerability, identified as CVE-2022-28391, allows remote attackers to execute arbitrary code by leveraging the netstat command to display a DNS PTR record's value on a VT compatible terminal. This flaw arises from improper handling of terminal color settings, which can be manipulated by an attacker. The potential ramifications include unauthorized access to system resources and execution of malicious commands, leading to severe security breaches.
How To Fix
Minimum fixed version
1.31.1-r22
This is the first release that contains the fix.
sudo apk add --upgrade busyboxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the netstat command to print DNS PTR records or configure their terminal settings to prevent color manipulation. Additionally, consider using alternative tools that do not exhibit this vulnerability.
Conclusion
CVE-2022-28391 is a critical vulnerability in BusyBox that can lead to remote code execution. Users are strongly advised to update to the latest patched versions to secure their systems. Temporary workarounds are available, but updating is the most effective solution.
See every vulnerability recorded for busybox →
FAQ
CVE-2022-28391 is a vulnerability in BusyBox that allows remote code execution through improper handling of terminal color settings when using the netstat command.
Affected versions include BusyBox versions prior to 1.31.1-r22 for Alpine v3.12, 1.32.1-r8 for Alpine v3.13, and 1.33.1-r7 for Alpine v3.14, among others.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2022-28391 is 8.8, indicating a high severity level.
If immediate updates are not possible, avoid using the netstat command to print DNS PTR records and consider alternative tools to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for busybox.
