Arbitrary Code Execution in BusyBox
Summary
CVE-2022-28391: BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Affects busybox across 2 version ranges.
< 1.31.1-r22
< e512aeb0fb3c585948ae6517cfdf4a53cf99774d
Fixed in 1.31.1-r22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
BusyBox is a lightweight and versatile set of Unix utilities commonly used in embedded systems and small Linux distributions. It provides a single binary that combines multiple common command-line tools, reducing the size and complexity of the system. However, BusyBox versions up to 1.35.0 are vulnerable to arbitrary code execution when using the 'netstat' command to print a DNS PTR record's value to a VT compatible terminal. This vulnerability can be exploited remotely, allowing attackers to execute arbitrary code or change the terminal's colors.
Vulnerability Detail
The vulnerability (CVE-2022-28391) in BusyBox allows remote attackers to execute arbitrary code or change the terminal's colors. By manipulating the 'netstat' command to print a DNS PTR record's value to a VT compatible terminal, an attacker can inject malicious code and gain unauthorized access to the system. This can lead to various consequences, including unauthorized data access, privilege escalation, and system compromise.
How To Fix
Minimum fixed version
1.31.1-r22
This is the first release that contains the fix.
sudo apk add --upgrade busyboxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid using the 'netstat' command to print DNS PTR records' values to a VT compatible terminal. By refraining from executing this specific command, the risk of arbitrary code execution or color manipulation can be mitigated. However, this workaround may limit the functionality of the system and is not a permanent solution. It is strongly recommended to update BusyBox to a fixed version as soon as possible.
Conclusion
The vulnerability in BusyBox allows remote attackers to execute arbitrary code or change the terminal's colors. To mitigate this vulnerability, it is crucial to update BusyBox to a fixed version. Avoiding the use of the 'netstat' command to print DNS PTR records' values to a VT compatible terminal can serve as a temporary workaround. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for busybox →
FAQ
BusyBox is a lightweight set of Unix utilities commonly used in embedded systems and small Linux distributions. It provides a single binary that combines multiple command-line tools, reducing the size and complexity of the system.
This vulnerability allows remote attackers to execute arbitrary code or change the terminal's colors. It can lead to unauthorized access, data breaches, privilege escalation, and system compromise.
To fix this vulnerability, update BusyBox to a fixed version. Refer to the provided fixed versions for different Alpine Linux distributions and update accordingly.
A temporary workaround is to avoid using the 'netstat' command to print DNS PTR records' values to a VT compatible terminal. However, this is not a permanent solution, and updating to a fixed version is strongly recommended.
For more information about this vulnerability, refer to the provided source link: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28391.json
Related vulnerabilities
Recent vulnerabilities recorded for busybox.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
