mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 16:01:54 -09:00
7cac2f9a13
Based on the work of the Debian community, this patch fixes the
following vulnerability:
This CVE hasn't been addressed upstream and the bugs discussion is 404
[1]. But the same patch is applied on Busybox v1.38 in Yocto & Debian.
- CVE-2024-58251:
In netstat in BusyBox through 1.37.0, local users can launch of
network application with an argv[0] containing an ANSI terminal escape
sequence, leading to a denial of service (terminal locked up) when
netstat is used by a victim.
For more information, see:
- https://salsa.debian.org/installer-team/busybox/-/blob/master/debian/patches/netstat-sanitize-argv0-for-p-CVE-2024-58251.patch
- https://www.cve.org/CVERecord?id=CVE-2024-58251
This patch is still applied on Debian & Yocto as of busybox version
1.38.
[1] https://bugs.busybox.net/show_bug.cgi?id=15922
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0e94f8d4de)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>