Executive brief
BusyBox is a software suite that provides several Unix utilities in a single executable, commonly used in embedded systems and Linux distributions. A vulnerability in its command shell component (ash) could allow a local user to crash the shell by providing specially crafted input. This results in a denial-of-service, potentially disrupting system operations or scripts that rely on the shell.
Technical details
A vulnerability exists in the ash shell component of BusyBox v1.38.0 within the ifsbreakup() function in shell/ash.c. The issue stems from the function skipping over control characters (CTLESC) without verifying if the subsequent byte remains within the bounds of the recorded memory region. If a CTLESC character is the final byte in a region, the pointer increments past the allocated buffer, leading to an out-of-bounds read or heap overflow. Additionally, the function may use stale region data after error unwinding. An attacker can exploit this by providing crafted input to the shell, leading to a crash (DoS). A patch has been proposed to cap scans to the current stack block and validate bounds during character processing.
Affected products
- BusyBox BusyBox 1.38.0
Timeline
- 2026-06-16: patched: Patch submitted to BusyBox mailing list
- 2026-07-15: disclosed: CVE published to NVD