I reviewed busybox 1:1.38.0-3ubuntu4 as checked into stonking. This shouldn't be
considered a full audit but rather a quick gauge of maintainability. This review
covers the promotion of bin:busybox only; busybox-static, busybox-udeb,
busybox-syslogd, udhcpc and udhcpd are not covered.
busybox is a single executable combining minimalist versions of many
common UNIX utilities (shell, coreutils, tar, awk, grep, wget, udhcpc, login,
syslogd, init, etc.), written in size-optimized C with applets selected at
compile time. In Ubuntu it is used for early-boot/initramfs operation and
recovery (busybox-initramfs was removed in favour of bin:busybox; dracut-core
recommends busybox), which means it runs as root in the initramfs and parses
untrusted input (archives, network data, filesystems). It implements its own
minimal TLS stack and ships authentication applets (login, passwd, su), giving
it a broad and security-sensitive attack surface despite its small size.
- CVE History
- 49 CVEs recorded since 2003, with a steady stream reflecting busybox's
broad attack surface (shell, awk, tar, wget, udhcp, syslogd); the 2021
ash/applet cluster (15 CVEs) and 2023 awk use-after-free cluster were
fixed promptly by upstream and in Ubuntu.
- 4 CVEs are still marked needed in stonking: CVE-2023-42366 (awk
heap-buffer overflow in next_token()), CVE-2024-58251 (netstat terminal
escape injection), CVE-2025-46394 (tar filename terminal escape
injection), CVE-2025-60876 (wget HTTP header injection); none has a
published fix confirmed in 1.38.0 yet.
- 16 CVEs from 2026 are untriaged; CVE-2026-26157, CVE-2026-26158 (archive
extraction path/link sanitization) and CVE-2026-29004 (udhcpc6 DHCPv6
heap overflow) appear fixed by commits already included in 1.38.0, and
Debian patches for CVE-2023-42366, CVE-2024-58251, CVE-2025-46394,
CVE-2025-60876, CVE-2026-38752, CVE-2026-38753, CVE-2026-38754 and
CVE-2026-38755 are carried in the packaged 1:1.38.0-3ubuntu4 (see
debian/patches/); these 20 CVEs remain open.
- Build-Depends
- Minimal: debhelper-compat (= 13) and zip (check profile, used by the
testsuite only); no sensitive libraries, no vendored code, no
autotools; busybox implements its own TLS and everything else in-tree,
and the built busybox links only against libc and libresolv, both in
main. /usr/bin/busybox carries full hardening (PIE, stack protector,
FORTIFY, full RELRO, stack-clash protection).
- pre/post inst/rm scripts
- None
- init scripts
- None
- systemd units
- None in bin:busybox; busybox-syslogd.service, busybox-klogd.service and
udhcpd.service (running as root, no systemd sandboxing directives) ship
only in the non-promoted sibling packages, so promotion of bin:busybox
activates no service.
- dbus services
- None
- setuid binaries
- None (no setuid binaries, no file capabilities).
- binaries in PATH
- /usr/bin/busybox is a single multi-call binary embedding all applets
(ls, tar, awk, ash, mount, passwd, su, udhcpc, syslogd, ...) with normal
root:root 0755 permissions and no installed symlinks; vulnerabilities in
any applet are reachable through it where it runs as root (initramfs,
recovery), but there is no setuid amplification.
- sudo fragments
- None
- polkit files
- None
- udev rules
- None
- unit tests / autopkgtests
- Upstream testsuite runs during package build per flavour and in the
deb build it passes: 951 PASS, 0 FAIL, 19 SKIP (skips are root-only,
arch-specific or known-bug markers). This upload (1:1.38.0-3ubuntu4)
also newly adds autopkgtest support (Testsuite: autopkgtest; two tests
running the upstream testsuite for the deb and static flavours), which
replaces the previously failing autopkgtest situation
- cron jobs
- None
- Build logs
- Build succeeds with no compiler errors
- warnings worth fixing but non-blocking: 38 ignored return values
(-Wunused-result), including fchown in libbb/update_passwd.c (silent
failure while updating /etc/passwd) and chown during archive
extraction (archival/libarchive/data_extract_all.c, archival/rpm.c,
util-linux/mdev.c) - real error-handling gaps for root-run applets;
plus format-truncation in miscutils/i2c_tools.c and a
maybe-uninitialized in miscutils/less.c, both low impact.
- Processes spawned
- Applets spawn external commands by design (ash/hush, crond running
/etc/crontab entries, mdev running mdev.conf actions via system(),
watch, tar --to-command, bootchartd, man); commands are admin- or
user-provided in every case, and no attacker-controlled format string
or hidden call site was found, so no injection surface beyond the
documented behavior.
- Memory management
- Defensive overall: applets consistently use libbb xmalloc/xrealloc/
xasprintf wrappers that exit on out-of-memory, and sprintf formats are
constant; the residual memory-safety hotspots (use-after-free clusters
in shell/ash.c and findutils/grep.c, a double free in bb_unsetenv at
libbb/xfuncs_printf.c:407, and fixed-buffer copies in
libbb/verror_msg.c used by all applets) are listed under Coverity.
- File IO
- Careful in the sensitive paths: passwd/group updates go through
update_passwd with O_CREAT|O_EXCL, 0600 and preserved owner/mode,
passwd applies umask(077), and unzip opens files with O_NOFOLLOW;
the remaining exposure is the stat-then-open TOCTOU during archive
extraction and copy (see Coverity), which runs as root in the
initramfs/recovery use case.
- Logging
- None (all logging goes through bb_error_msg/vfprintf wrappers with
constant format strings; no tainted format strings found).
- Environment variable usage
- login clears LD_LIBRARY_PATH and LD_PRELOAD before spawning the user
shell (libbb/login.c), which is the right hygiene; mdev/uevent instead
export kernel-netlink-derived strings into the environment of root-run
helper scripts (see Coverity), and sulogin picks the single-user shell
from the SUSHELL/sushell variables (legacy, console-root context).
- Use of privileged functions
- No setuid bit is shipped: the binary runs with caller privileges only
(CONFIG_FEATURE_SUID only enables an optional /etc/busybox.conf uid
mapping for setuid installs, which Ubuntu does not use); the drop-
privilege paths use setresgid/setresuid behind die-on-failure wrappers,
and chroot/switch_root/chpst all chdir("/") after chrooting.
- Use of cryptography / random number sources etc
- busybox ships its own TLS 1.2 stack (networking/tls.c, matrixssl-derived)
used by `wget https` and ssl_client, and it performs no certificate
chain/CA validation or server identity check (tls.c:1505: "we do not
verify cert validity") - a documented upstream design decision; in the
Ubuntu build `wget https` prefers the openssl s_client helper, which
does validate, so the unvalidated path is reached only when the openssl
binary is absent (the initramfs hook copies openssl and CA certs for
exactly this case). The two Coverity hits in this stack (tls.c:2725
out-of-bounds write, tls_rsa.c:113 copy-paste) were checked against the
source and are false positives: the flagged write targets the "+4+512"
signature space explicitly allocated at tls.c:2677, and the flagged
line is the textbook RSA-CRT recombination inherited from matrixssl.
- rand() (predictable libc generator) is used for DHCP transaction IDs
(networking/udhcp/dhcpc.c:586), aiding DHCP spoofing slightly; passwd
hashing itself uses the modern yescrypt from libbb.
- Use of temp files
- None (all temporary files use mkstemp X-templates with O_EXCL: sed -i,
diff, lpr, bootchartd, crontab; no predictable /tmp names).
- Use of networking
- Nothing in the binary listens on the network by default, so
there is no remote attack surface unless an admin deliberately starts
a server applet (httpd, telnetd, udhcpd); the client applets parse
untrusted network input defensively, and the one heap overflow this
code ever had (CVE-2026-29004) is fixed in 1.38.0. The residual
DHCP exposure is inherent to the protocol: a rogue DHCP server can
dictate your IP, gateway and DNS - the same trust model every DHCP
client in main has - so no action is needed here.
- Use of WebKit
- N/A (not used).
- Use of PolicyKit
- N/A (no sudo, pkexec or polkit integration anywhere in the package).
- Any significant cppcheck results
- Mostly tool noise; the out-of-scope buffer pointer in the HMAC key
path (libbb/hash_hmac.c:44) is also a tool artifact (only ever read,
and the affected code path is unreachable in this build).
- An out-of-bounds write in the SGI fdisk code is flagged
(util-linux/fdisk_sgi.c:138) which can lead to memory corruption, but
only reachable when an admin runs fdisk on attacker-supplied storage
carrying a rare SGI disk label - a niche bug worth an upstream patch,
not a promotion risk.
- Any significant Coverity results
- 897 defect occurrences in shipped code; the tar/ar header and DHCPv6
option-parsing hits are benign patterns, not bugs. The
security-significant cluster is time-of-check/time-of-use races in
root archive extraction and copy
(archival/libarchive/data_extract_all.c:116, libbb/copy_file.c:102):
a racing local user could redirect what a root extraction overwrites,
but the classic tar symlink trick is already blocked by the
CVE-2026-26157/26158 fixes in this version, leaving only the narrow
race window that upstream keeps promptly patching.
- Environment injection in the root-run hotplug helpers
(util-linux/uevent.c:114, mdev.c:1226) and predictable random numbers
for DHCP transaction IDs (dhcpc.c:586): the environment values can
only be fed by the kernel and mdev is not used on Ubuntu, and
predictable IDs only marginally help off-path DHCP spoofing - low
impact, worth fixes, not promotion risks.
- Any significant shellcheck results
- 1365 warnings, almost all in build scripts, examples and test
infrastructure (ignorable per the package's own notes)
- a non-noise find is the shipped udhcpc default.script, where
DHCP-server- controlled values ($ip, $subnet, $lease) are used
unquoted in a root-run script. a malicious DHCP server could
theoretically mangle the arguments of the commands the script runs,
but the values are never evaluated, so it cannot run commands of its
own choosing.
- Any significant bandit results
- None
- Any significant govulncheck results
- N/A (not a Go project; no go.mod).
- Any significant Semgrep results
- None
busybox is not a library: nothing links against it and bin:busybox declares no
Built-Using/Static-Built-Using (only busybox-static, which stays in universe,
statically links glibc). Its consumers (initramfs-tools, casper, cryptsetup,
dracut, zfs-initramfs, dropbear-initramfs and friends) copy the whole binary
into the initramfs, so a busybox security fix needs only a busybox rebuild;
regenerating initramfs images on upgrade is already handled by the standard
update-initramfs hooks, and no FIPS/certification coupling exists.
Security team ACK for promoting bin:busybox as checked into stonking to
main.
** CVE added: https://cve.org/CVERecord?id=CVE-2023-42366
** CVE added: https://cve.org/CVERecord?id=CVE-2024-58251
** CVE added: https://cve.org/CVERecord?id=CVE-2025-46394
** CVE added: https://cve.org/CVERecord?id=CVE-2025-60876
** CVE added: https://cve.org/CVERecord?id=CVE-2026-26157
** CVE added: https://cve.org/CVERecord?id=CVE-2026-26158
** CVE added: https://cve.org/CVERecord?id=CVE-2026-29004
** CVE added: https://cve.org/CVERecord?id=CVE-2026-38752
** CVE added: https://cve.org/CVERecord?id=CVE-2026-38753
** CVE added: https://cve.org/CVERecord?id=CVE-2026-38754
** CVE added: https://cve.org/CVERecord?id=CVE-2026-38755
** Changed in: busybox (Ubuntu)
Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)
** Changed in: busybox (Ubuntu)
Status: New => In Progress
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166895
Title:
[MIR] busybox
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/busybox/+bug/2166895/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
