* [Buildroot] [PATCH 2025.02.x RESEND 2/5] package/busybox: patch CVE-2024-58251
2026-08-11 11:42 [Buildroot] [PATCH 2025.02.x RESEND 1/5] package/busybox: re-introduce IGNORE_CVES for CVE-2023-42366 Thomas Perale via buildroot
@ 2026-08-11 11:42 ` Thomas Perale via buildroot
2026-08-11 11:42 ` [Buildroot] [PATCH 2025.02.x RESEND 3/5] package/busybox: patch CVE-2023-39810 Thomas Perale via buildroot
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Thomas Perale via buildroot @ 2026-08-11 11:42 UTC (permalink / raw)
To: buildroot
Based on the work of the Debian community, this patch fixes the
following vulnerability:
- CVE-2024-58251:
In netstat in BusyBox through 1.37.0, local users can launch of
network application with an argv[0] containing an ANSI terminal escape
sequence, leading to a denial of service (terminal locked up) when
netstat is used by a victim.
For more information, see:
- https://salsa.debian.org/installer-team/busybox/-/blob/master/debian/patches/netstat-sanitize-argv0-for-p-CVE-2024-58251.patch
- https://www.cve.org/CVERecord?id=CVE-2024-58251
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
...-sanitize-argv0-for-p-CVE-2024-58251.patch | 50 +++++++++++++++++++
package/busybox/busybox.mk | 3 ++
2 files changed, 53 insertions(+)
create mode 100644 package/busybox/0015-netstat-sanitize-argv0-for-p-CVE-2024-58251.patch
diff --git a/package/busybox/0015-netstat-sanitize-argv0-for-p-CVE-2024-58251.patch b/package/busybox/0015-netstat-sanitize-argv0-for-p-CVE-2024-58251.patch
new file mode 100644
index 0000000000..5891424c00
--- /dev/null
+++ b/package/busybox/0015-netstat-sanitize-argv0-for-p-CVE-2024-58251.patch
@@ -0,0 +1,50 @@
+From: Valery Ushakov <valery.ushakov@bell-sw.com>
+Date: Thu, 21 Aug 2025 12:31:53 +0000
+Subject: netstat: CVE-2024-58251 - sanitize argv0 for -p
+Bug-Debian: https://bugs.debian.org/1104009
+
+Signed-off-by: Valery Ushakov <valery.ushakov@bell-sw.com>
+Upstream: https://salsa.debian.org/installer-team/busybox/-/blob/master/debian/patches/netstat-sanitize-argv0-for-p-CVE-2024-58251.patch
+CVE: CVE-2024-58251
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ networking/netstat.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/networking/netstat.c b/networking/netstat.c
+index 807800a62..d979f6079 100644
+--- a/networking/netstat.c
++++ b/networking/netstat.c
+@@ -41,6 +41,7 @@
+
+ #include "libbb.h"
+ #include "inet_common.h"
++#include "unicode.h"
+
+ //usage:#define netstat_trivial_usage
+ //usage: "[-"IF_ROUTE("r")"al] [-tuwx] [-en"IF_FEATURE_NETSTAT_WIDE("W")IF_FEATURE_NETSTAT_PRG("p")"]"
+@@ -314,9 +315,12 @@ static int FAST_FUNC dir_act(struct recursive_state *state,
+ return FALSE;
+ cmdline_buf[n] = '\0';
+
++ /* don't write process-controlled argv[0] to the user's terminal as-is */
++ const char *argv0base = printable_string(bb_basename(cmdline_buf));
++
+ /* go through all files in /proc/PID/fd and check whether they are sockets */
+ strcpy(proc_pid_fname + len - (sizeof("cmdline")-1), "fd");
+- pid_slash_progname = concat_path_file(pid, bb_basename(cmdline_buf)); /* "PID/argv0" */
++ pid_slash_progname = concat_path_file(pid, argv0base); /* "PID/argv0" */
+ n = recursive_action(proc_pid_fname,
+ ACTION_RECURSE | ACTION_QUIET,
+ add_to_prg_cache_if_socket,
+@@ -686,6 +690,7 @@ int netstat_main(int argc UNUSED_PARAM, char **argv)
+ unsigned opt;
+
+ INIT_G();
++ init_unicode();
+
+ /* Option string must match NETSTAT_xxx constants */
+ opt = getopt32(argv, NETSTAT_OPTS);
+--
+2.34.1
+
diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk
index 092fd5d1e1..0488518086 100644
--- a/package/busybox/busybox.mk
+++ b/package/busybox/busybox.mk
@@ -19,6 +19,9 @@ BUSYBOX_IGNORE_CVES += CVE-2022-28391
# 0008-awk.c-fix-CVE-2023-42366-bug-15874.patch
BUSYBOX_IGNORE_CVES += CVE-2023-42366
+# 0015-netstat-sanitize-argv0-for-p-CVE-2024-58251.patch
+BUSYBOX_IGNORE_CVES += CVE-2024-58251
+
# 0012-archival-libarchive-sanitize-filenames-on-output.patch
# 0013-testsuite-tar-tests-fix-test-after-cve-2025-46394.patch
BUSYBOX_IGNORE_CVES += CVE-2025-46394
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 6+ messages in thread* [Buildroot] [PATCH 2025.02.x RESEND 3/5] package/busybox: patch CVE-2023-39810
2026-08-11 11:42 [Buildroot] [PATCH 2025.02.x RESEND 1/5] package/busybox: re-introduce IGNORE_CVES for CVE-2023-42366 Thomas Perale via buildroot
2026-08-11 11:42 ` [Buildroot] [PATCH 2025.02.x RESEND 2/5] package/busybox: patch CVE-2024-58251 Thomas Perale via buildroot
@ 2026-08-11 11:42 ` Thomas Perale via buildroot
2026-08-11 11:42 ` [Buildroot] [PATCH 2025.02.x RESEND 4/5] package/busybox: patch CVE-2026-2615{7, 8} Thomas Perale via buildroot
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Thomas Perale via buildroot @ 2026-08-11 11:42 UTC (permalink / raw)
To: buildroot
Based on the work of the Debian community, this commit patches the
following vulnerability.
- CVE-2023-39810:
An issue in the CPIO command of Busybox v1.33.2 allows attackers to
execute a directory traversal.
For more information, see:
- https://salsa.debian.org/installer-team/busybox/-/blob/master/debian/patches/archival-disallow-path-traversals-CVE-2023-39810.patch
- https://www.cve.org/CVERecord?id=CVE-2023-39810
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
...allow-path-traversals-CVE-2023-39810.patch | 126 ++++++++++++++++++
package/busybox/busybox.mk | 3 +
2 files changed, 129 insertions(+)
create mode 100644 package/busybox/0016-archival-disallow-path-traversals-CVE-2023-39810.patch
diff --git a/package/busybox/0016-archival-disallow-path-traversals-CVE-2023-39810.patch b/package/busybox/0016-archival-disallow-path-traversals-CVE-2023-39810.patch
new file mode 100644
index 0000000000..cea4e7de9a
--- /dev/null
+++ b/package/busybox/0016-archival-disallow-path-traversals-CVE-2023-39810.patch
@@ -0,0 +1,126 @@
+Commit-ID: 9a8796436b9b0641e13480811902ea2ac57881d3
+From: Denys Vlasenko <vda.linux@googlemail.com>
+Date: Wed, 2 Oct 2024 10:12:05 +0200
+Subject: archival: disallow path traversals (CVE-2023-39810)
+Origin: upstream, https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641e13480811902ea2ac57881d3
+Forwarded: not-needed
+Bug-Debian: https://bugs.debian.org/1055307
+
+Create new configure option for archival/libarchive based extractions to
+disallow path traversals.
+As this is a paranoid option and might introduce backward
+incompatibility, default it to no.
+
+Based on the patch by Peter Kaestle <peter.kaestle@nokia.com>
+
+function old new delta
+data_extract_all 921 945 +24
+strip_unsafe_prefix 101 102 +1
+------------------------------------------------------------------------------
+(add/remove: 0/0 grow/shrink: 2/0 up/down: 25/0) Total: 25 bytes
+
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+CVE: CVE-2023-39810
+Upstream: https://salsa.debian.org/installer-team/busybox/-/blob/master/debian/patches/archival-disallow-path-traversals-CVE-2023-39810.patch
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ archival/Config.src | 11 +++++++++++
+ archival/libarchive/data_extract_all.c | 8 ++++++++
+ archival/libarchive/unsafe_prefix.c | 6 +++++-
+ scripts/kconfig/lxdialog/check-lxdialog.sh | 2 +-
+ testsuite/cpio.tests | 23 ++++++++++++++++++++++
+ 5 files changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/archival/Config.src b/archival/Config.src
+index 6f4f30c43..cbcd7217c 100644
+--- a/archival/Config.src
++++ b/archival/Config.src
+@@ -35,4 +35,15 @@ config FEATURE_LZMA_FAST
+ This option reduces decompression time by about 25% at the cost of
+ a 1K bigger binary.
+
++config FEATURE_PATH_TRAVERSAL_PROTECTION
++ bool "Prevent extraction of filenames with /../ path component"
++ default n
++ help
++ busybox tar and unzip remove "PREFIX/../" (if it exists)
++ from extracted names.
++ This option enables this behavior for all other unpacking applets,
++ such as cpio, ar, rpm.
++ GNU cpio 2.15 has NO such sanity check.
++# try other archivers and document their behavior?
++
+ endmenu
+diff --git a/archival/libarchive/data_extract_all.c b/archival/libarchive/data_extract_all.c
+index 049c2c156..8a69711c1 100644
+--- a/archival/libarchive/data_extract_all.c
++++ b/archival/libarchive/data_extract_all.c
+@@ -65,6 +65,14 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle)
+ } while (--n != 0);
+ }
+ #endif
++#if ENABLE_FEATURE_PATH_TRAVERSAL_PROTECTION
++ /* Strip leading "/" and up to last "/../" path component */
++ dst_name = (char *)strip_unsafe_prefix(dst_name);
++#endif
++// ^^^ This may be a problem if some applets do need to extract absolute names.
++// (Probably will need to invent ARCHIVE_ALLOW_UNSAFE_NAME flag).
++// You might think that rpm needs it, but in my tests rpm's internal cpio
++// archive has names like "./usr/bin/FOO", not "/usr/bin/FOO".
+
+ if (archive_handle->ah_flags & ARCHIVE_CREATE_LEADING_DIRS) {
+ char *slash = strrchr(dst_name, '/');
+diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c
+index 33e487bf9..667081195 100644
+--- a/archival/libarchive/unsafe_prefix.c
++++ b/archival/libarchive/unsafe_prefix.c
+@@ -14,7 +14,11 @@ const char* FAST_FUNC strip_unsafe_prefix(const char *str)
+ cp++;
+ continue;
+ }
+- if (is_prefixed_with(cp, "/../"+1)) {
++ /* We are called lots of times.
++ * is_prefixed_with(cp, "../") is slower than open-coding it,
++ * with minimal code growth (~few bytes).
++ */
++ if (cp[0] == '.' && cp[1] == '.' && cp[2] == '/') {
+ cp += 3;
+ continue;
+ }
+diff --git a/testsuite/cpio.tests b/testsuite/cpio.tests
+index 85e746589..a4462c53e 100755
+--- a/testsuite/cpio.tests
++++ b/testsuite/cpio.tests
+@@ -154,6 +154,29 @@ testing "cpio -R with extract" \
+ " "" ""
+ SKIP=
+
++# Create an archive containing a file with "../dont_write" filename.
++# See that it will not be allowed to unpack.
++# NB: GNU cpio 2.15 DOES NOT do such checks.
++optional FEATURE_PATH_TRAVERSAL_PROTECTION
++rm -rf cpio.testdir
++mkdir -p cpio.testdir/prepare/inner
++echo "file outside of destination was written" > cpio.testdir/prepare/dont_write
++echo "data" > cpio.testdir/prepare/inner/to_extract
++mkdir -p cpio.testdir/extract
++testing "cpio extract file outside of destination" "\
++(cd cpio.testdir/prepare/inner && $ECHO -e '../dont_write\nto_extract' | cpio -o -H newc) | (cd cpio.testdir/extract && cpio -vi 2>&1)
++echo \$?
++ls cpio.testdir/dont_write 2>&1" \
++"\
++cpio: removing leading '../' from member names
++../dont_write
++to_extract
++1 blocks
++0
++ls: cpio.testdir/dont_write: No such file or directory
++" "" ""
++SKIP=
++
+ # Clean up
+ rm -rf cpio.testdir cpio.testdir2 2>/dev/null
+
+--
+2.47.2
+
diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk
index 0488518086..91d3b69139 100644
--- a/package/busybox/busybox.mk
+++ b/package/busybox/busybox.mk
@@ -19,6 +19,9 @@ BUSYBOX_IGNORE_CVES += CVE-2022-28391
# 0008-awk.c-fix-CVE-2023-42366-bug-15874.patch
BUSYBOX_IGNORE_CVES += CVE-2023-42366
+# 0016-archival-disallow-path-traversals-CVE-2023-39810.patch
+BUSYBOX_IGNORE_CVES += CVE-2023-39810
+
# 0015-netstat-sanitize-argv0-for-p-CVE-2024-58251.patch
BUSYBOX_IGNORE_CVES += CVE-2024-58251
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 6+ messages in thread* [Buildroot] [PATCH 2025.02.x RESEND 4/5] package/busybox: patch CVE-2026-2615{7, 8}
2026-08-11 11:42 [Buildroot] [PATCH 2025.02.x RESEND 1/5] package/busybox: re-introduce IGNORE_CVES for CVE-2023-42366 Thomas Perale via buildroot
2026-08-11 11:42 ` [Buildroot] [PATCH 2025.02.x RESEND 2/5] package/busybox: patch CVE-2024-58251 Thomas Perale via buildroot
2026-08-11 11:42 ` [Buildroot] [PATCH 2025.02.x RESEND 3/5] package/busybox: patch CVE-2023-39810 Thomas Perale via buildroot
@ 2026-08-11 11:42 ` Thomas Perale via buildroot
2026-08-11 11:42 ` [Buildroot] [PATCH 2025.02.x RESEND 5/5] package/busybox: patch CVE-2026-29004 Thomas Perale via buildroot
2026-08-22 12:07 ` [Buildroot] [PATCH 2025.02.x RESEND 1/5] package/busybox: re-introduce IGNORE_CVES for CVE-2023-42366 Titouan Christophe via buildroot
4 siblings, 0 replies; 6+ messages in thread
From: Thomas Perale via buildroot @ 2026-08-11 11:42 UTC (permalink / raw)
To: buildroot
Based on the work of the OpenEmbedded community. This commit patches the
following vulnerabilities:
- CVE-2026-26157:
A flaw was found in BusyBox. Incomplete path sanitization in its
archive extraction utilities allows an attacker to craft malicious
archives that when extracted, and under specific conditions, may write
to files outside the intended directory. This can lead to arbitrary
file overwrite, potentially enabling code execution through the
modification of sensitive system files.
https://www.cve.org/CVERecord?id=CVE-2026-26157
- CVE-2026-26158:
A flaw was found in BusyBox. This vulnerability allows an attacker to
modify files outside of the intended extraction directory by crafting
a malicious tar archive containing unvalidated hardlink or symlink
entries. If the tar archive is extracted with elevated privileges,
this flaw can lead to privilege escalation, enabling an attacker to
gain unauthorized access to critical system files.
https://www.cve.org/CVERecord?id=CVE-2026-26158
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
...tar-strip-unsafe-hardlink-components.patch | 198 ++++++++++++++++++
...rip-unsafe-components-from-hardlinks.patch | 38 ++++
package/busybox/busybox.mk | 4 +
3 files changed, 240 insertions(+)
create mode 100644 package/busybox/0017-tar-strip-unsafe-hardlink-components.patch
create mode 100644 package/busybox/0018-only-strip-unsafe-components-from-hardlinks.patch
diff --git a/package/busybox/0017-tar-strip-unsafe-hardlink-components.patch b/package/busybox/0017-tar-strip-unsafe-hardlink-components.patch
new file mode 100644
index 0000000000..604f1a4f9b
--- /dev/null
+++ b/package/busybox/0017-tar-strip-unsafe-hardlink-components.patch
@@ -0,0 +1,198 @@
+From 3fb6b31c716669e12f75a2accd31bb7685b1a1cb Mon Sep 17 00:00:00 2001
+From: Denys Vlasenko <vda.linux@googlemail.com>
+Date: Thu, 29 Jan 2026 11:48:02 +0100
+Subject: [PATCH] tar: strip unsafe hardlink components - GNU tar does the same
+
+Defends against files like these (python reproducer):
+
+import tarfile
+ti = tarfile.TarInfo("leak_hosts")
+ti.type = tarfile.LNKTYPE
+ti.linkname = "/etc/hosts" # or "../etc/hosts" or ".."
+ti.size = 0
+with tarfile.open("/tmp/hardlink.tar", "w") as t:
+ t.addfile(ti)
+
+function old new delta
+skip_unsafe_prefix - 127 +127
+get_header_tar 1752 1754 +2
+.rodata 106861 106856 -5
+unzip_main 2715 2706 -9
+strip_unsafe_prefix 102 18 -84
+(add/remove: 1/0 grow/shrink: 1/3 up/down: 129/-98) Total: 31 bytes
+
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+
+CVE: CVE-2026-26157
+CVE: CVE-2026-26158
+Upstream: https://git.busybox.net/busybox/commit/?id=3fb6b31c716669e12f75a2accd31bb7685b1a1cb
+Upstream: https://gogs.librecmc.org/OWEALS/busybox/commit/3fb6b31c716669e12f75a2accd31bb7685b1a1cb
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ archival/libarchive/data_extract_all.c | 7 +++--
+ archival/libarchive/get_header_tar.c | 11 ++++++--
+ archival/libarchive/unsafe_prefix.c | 30 +++++++++++++++++----
+ archival/libarchive/unsafe_symlink_target.c | 1 +
+ archival/tar.c | 2 +-
+ archival/unzip.c | 2 +-
+ include/bb_archive.h | 3 ++-
+ 7 files changed, 42 insertions(+), 14 deletions(-)
+
+diff --git a/archival/libarchive/data_extract_all.c b/archival/libarchive/data_extract_all.c
+index 8a69711..b84b960 100644
+--- a/archival/libarchive/data_extract_all.c
++++ b/archival/libarchive/data_extract_all.c
+@@ -66,8 +66,8 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle)
+ }
+ #endif
+ #if ENABLE_FEATURE_PATH_TRAVERSAL_PROTECTION
+- /* Strip leading "/" and up to last "/../" path component */
+- dst_name = (char *)strip_unsafe_prefix(dst_name);
++ /* Skip leading "/" and past last ".." path component */
++ dst_name = (char *)skip_unsafe_prefix(dst_name);
+ #endif
+ // ^^^ This may be a problem if some applets do need to extract absolute names.
+ // (Probably will need to invent ARCHIVE_ALLOW_UNSAFE_NAME flag).
+@@ -185,8 +185,7 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle)
+
+ /* To avoid a directory traversal attack via symlinks,
+ * do not restore symlinks with ".." components
+- * or symlinks starting with "/", unless a magic
+- * envvar is set.
++ * or symlinks starting with "/"
+ *
+ * For example, consider a .tar created via:
+ * $ tar cvf bug.tar anything.txt
+diff --git a/archival/libarchive/get_header_tar.c b/archival/libarchive/get_header_tar.c
+index cc6f3f0..1c40ece 100644
+--- a/archival/libarchive/get_header_tar.c
++++ b/archival/libarchive/get_header_tar.c
+@@ -454,8 +454,15 @@ char FAST_FUNC get_header_tar(archive_handle_t *archive_handle)
+ #endif
+
+ /* Everything up to and including last ".." component is stripped */
+- overlapping_strcpy(file_header->name, strip_unsafe_prefix(file_header->name));
+-//TODO: do the same for file_header->link_target?
++ strip_unsafe_prefix(file_header->name);
++ if (file_header->link_target) {
++ /* GNU tar 1.34 examples:
++ * tar: Removing leading '/' from hard link targets
++ * tar: Removing leading '../' from hard link targets
++ * tar: Removing leading 'etc/../' from hard link targets
++ */
++ strip_unsafe_prefix(file_header->link_target);
++ }
+
+ /* Strip trailing '/' in directories */
+ /* Must be done after mode is set as '/' is used to check if it's a directory */
+diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c
+index 6670811..89a371a 100644
+--- a/archival/libarchive/unsafe_prefix.c
++++ b/archival/libarchive/unsafe_prefix.c
+@@ -5,11 +5,11 @@
+ #include "libbb.h"
+ #include "bb_archive.h"
+
+-const char* FAST_FUNC strip_unsafe_prefix(const char *str)
++const char* FAST_FUNC skip_unsafe_prefix(const char *str)
+ {
+ const char *cp = str;
+ while (1) {
+- char *cp2;
++ const char *cp2;
+ if (*cp == '/') {
+ cp++;
+ continue;
+@@ -22,10 +22,25 @@ const char* FAST_FUNC strip_unsafe_prefix(const char *str)
+ cp += 3;
+ continue;
+ }
+- cp2 = strstr(cp, "/../");
++ cp2 = cp;
++ find_dotdot:
++ cp2 = strstr(cp2, "/..");
+ if (!cp2)
+- break;
+- cp = cp2 + 4;
++ break; /* No (more) malicious components */
++
++ /* We found "/..something" */
++ cp2 += 3;
++ if (*cp2 != '/') {
++ if (*cp2 == '\0') {
++ /* Trailing "/..": malicious, return "" */
++ /* (causes harmless errors trying to create or hardlink a file named "") */
++ return cp2;
++ }
++ /* "/..name" is not malicious, look for next "/.." */
++ goto find_dotdot;
++ }
++ /* Found "/../": malicious, advance past it */
++ cp = cp2 + 1;
+ }
+ if (cp != str) {
+ static smallint warned = 0;
+@@ -37,3 +52,8 @@ const char* FAST_FUNC strip_unsafe_prefix(const char *str)
+ }
+ return cp;
+ }
++
++void FAST_FUNC strip_unsafe_prefix(char *str)
++{
++ overlapping_strcpy(str, skip_unsafe_prefix(str));
++}
+diff --git a/archival/libarchive/unsafe_symlink_target.c b/archival/libarchive/unsafe_symlink_target.c
+index f8dc803..d764c89 100644
+--- a/archival/libarchive/unsafe_symlink_target.c
++++ b/archival/libarchive/unsafe_symlink_target.c
+@@ -36,6 +36,7 @@ void FAST_FUNC create_links_from_list(llist_t *list)
+ *list->data ? "hard" : "sym",
+ list->data + 1, target
+ );
++ /* Note: GNU tar 1.34 errors out only _after_ all links are (attempted to be) created */
+ }
+ list = list->link;
+ }
+diff --git a/archival/tar.c b/archival/tar.c
+index 9de3759..cf8c2d1 100644
+--- a/archival/tar.c
++++ b/archival/tar.c
+@@ -475,7 +475,7 @@ static int FAST_FUNC writeFileToTarball(struct recursive_state *state,
+ DBG("writeFileToTarball('%s')", fileName);
+
+ /* Strip leading '/' and such (must be before memorizing hardlink's name) */
+- header_name = strip_unsafe_prefix(fileName);
++ header_name = skip_unsafe_prefix(fileName);
+
+ if (header_name[0] == '\0')
+ return TRUE;
+diff --git a/archival/unzip.c b/archival/unzip.c
+index 691a2d8..5844215 100644
+--- a/archival/unzip.c
++++ b/archival/unzip.c
+@@ -860,7 +860,7 @@ int unzip_main(int argc, char **argv)
+
+ /* Guard against "/abspath", "/../" and similar attacks */
+ // NB: UnZip 6.00 has option -: to disable this
+- overlapping_strcpy(dst_fn, strip_unsafe_prefix(dst_fn));
++ strip_unsafe_prefix(dst_fn);
+
+ /* Filter zip entries */
+ if (find_list_entry(zreject, dst_fn)
+diff --git a/include/bb_archive.h b/include/bb_archive.h
+index e0ef8fc..1dc77f3 100644
+--- a/include/bb_archive.h
++++ b/include/bb_archive.h
+@@ -202,7 +202,8 @@ char get_header_tar_xz(archive_handle_t *archive_handle) FAST_FUNC;
+ void seek_by_jump(int fd, off_t amount) FAST_FUNC;
+ void seek_by_read(int fd, off_t amount) FAST_FUNC;
+
+-const char *strip_unsafe_prefix(const char *str) FAST_FUNC;
++const char *skip_unsafe_prefix(const char *str) FAST_FUNC;
++void strip_unsafe_prefix(char *str) FAST_FUNC;
+ void create_or_remember_link(llist_t **link_placeholders,
+ const char *target,
+ const char *linkname,
+--
+2.50.1
diff --git a/package/busybox/0018-only-strip-unsafe-components-from-hardlinks.patch b/package/busybox/0018-only-strip-unsafe-components-from-hardlinks.patch
new file mode 100644
index 0000000000..bcfbf5d4d2
--- /dev/null
+++ b/package/busybox/0018-only-strip-unsafe-components-from-hardlinks.patch
@@ -0,0 +1,38 @@
+From 599f5dd8fac390c18b79cba4c14c334957605dae Mon Sep 17 00:00:00 2001
+From: Radoslav Kolev <radoslav.kolev@suse.com>
+Date: Mon, 16 Feb 2026 11:50:04 +0200
+Subject: [PATCH] tar: only strip unsafe components from hardlinks, not
+ symlinks
+
+commit 3fb6b31c7 introduced a check for unsafe components in
+tar archive hardlinks, but it was being applied to symlinks too
+which broke "Symlinks and hardlinks coexist" tar test.
+
+Signed-off-by: Radoslav Kolev <radoslav.kolev@suse.com>
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+
+CVE: CVE-2026-26157
+CVE: CVE-2026-26158
+Upstream: https://git.busybox.net/busybox/commit/?id=599f5dd8fac390c18b79cba4c14c334957605dae
+Upstream: https://gogs.librecmc.org/OWEALS/busybox/commit/599f5dd8fac390c18b79cba4c14c334957605dae
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ archival/libarchive/get_header_tar.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/archival/libarchive/get_header_tar.c b/archival/libarchive/get_header_tar.c
+index 1c40ece..606d806 100644
+--- a/archival/libarchive/get_header_tar.c
++++ b/archival/libarchive/get_header_tar.c
+@@ -455,7 +455,7 @@ char FAST_FUNC get_header_tar(archive_handle_t *archive_handle)
+
+ /* Everything up to and including last ".." component is stripped */
+ strip_unsafe_prefix(file_header->name);
+- if (file_header->link_target) {
++ if (file_header->link_target && !S_ISLNK(file_header->mode)) {
+ /* GNU tar 1.34 examples:
+ * tar: Removing leading '/' from hard link targets
+ * tar: Removing leading '../' from hard link targets
+--
+2.50.1
diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk
index 91d3b69139..d3e0678200 100644
--- a/package/busybox/busybox.mk
+++ b/package/busybox/busybox.mk
@@ -32,6 +32,10 @@ BUSYBOX_IGNORE_CVES += CVE-2025-46394
# 0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch
BUSYBOX_IGNORE_CVES += CVE-2025-60876
+# 0017-tar-strip-unsafe-hardlink-components.patch
+# 0018-only-strip-unsafe-components-from-hardlinks.patch
+BUSYBOX_IGNORE_CVES += CVE-2026-26157 CVE-2026-26158
+
BUSYBOX_CFLAGS = \
$(TARGET_CFLAGS)
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 6+ messages in thread* [Buildroot] [PATCH 2025.02.x RESEND 5/5] package/busybox: patch CVE-2026-29004
2026-08-11 11:42 [Buildroot] [PATCH 2025.02.x RESEND 1/5] package/busybox: re-introduce IGNORE_CVES for CVE-2023-42366 Thomas Perale via buildroot
` (2 preceding siblings ...)
2026-08-11 11:42 ` [Buildroot] [PATCH 2025.02.x RESEND 4/5] package/busybox: patch CVE-2026-2615{7, 8} Thomas Perale via buildroot
@ 2026-08-11 11:42 ` Thomas Perale via buildroot
2026-08-22 12:07 ` [Buildroot] [PATCH 2025.02.x RESEND 1/5] package/busybox: re-introduce IGNORE_CVES for CVE-2023-42366 Titouan Christophe via buildroot
4 siblings, 0 replies; 6+ messages in thread
From: Thomas Perale via buildroot @ 2026-08-11 11:42 UTC (permalink / raw)
To: buildroot
Thanks to the OpenEmbedded community for the patches. This fixes the
following vulnerability:
- CVE-2026-29004:
BusyBox before commit 42202bf contains a heap buffer overflow
vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option
handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent
attackers to trigger memory corruption by sending a crafted DHCPv6
response with a malformed D6_OPT_DNS_SERVERS option. Attackers can
exploit incorrect heap buffer allocation calculations in the
option_to_env() function to cause denial of service or achieve
arbitrary code execution on embedded systems without heap hardening.
https://www.cve.org/CVERecord?id=CVE-2026-29004
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
package/busybox/0019-CVE-2026-29004-01.patch | 39 +++++++++++++++++
package/busybox/0020-CVE-2026-29004-02.patch | 45 ++++++++++++++++++++
package/busybox/busybox.mk | 4 ++
3 files changed, 88 insertions(+)
create mode 100644 package/busybox/0019-CVE-2026-29004-01.patch
create mode 100644 package/busybox/0020-CVE-2026-29004-02.patch
diff --git a/package/busybox/0019-CVE-2026-29004-01.patch b/package/busybox/0019-CVE-2026-29004-01.patch
new file mode 100644
index 0000000000..77ffd5f617
--- /dev/null
+++ b/package/busybox/0019-CVE-2026-29004-01.patch
@@ -0,0 +1,39 @@
+From d9a718cc17535c31d38f31fccb904a30e823166d Mon Sep 17 00:00:00 2001
+From: Denys Vlasenko <vda.linux@googlemail.com>
+Date: Thu, 12 Mar 2026 07:25:38 +0100
+Subject: [PATCH] udhcpc6: fix buffer overflow
+
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+
+Upstream: https://github.com/vda-linux/busybox_mirror/commit/42202bfb1e6ac51fa995beda8be4d7b654aeee2a
+CVE: CVE-2026-29004
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ networking/udhcp/d6_dhcpc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c
+index 79cef1999..d13b05829 100644
+--- a/networking/udhcp/d6_dhcpc.c
++++ b/networking/udhcp/d6_dhcpc.c
+@@ -351,15 +351,15 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end)
+ addrs = option[3] >> 4;
+
+ /* Setup environment variable */
+- *new_env() = dlist = xmalloc(4 + addrs * 40 - 1);
++ *new_env() = dlist = xmalloc(4 + addrs * 40 + 1);
+ dlist = stpcpy(dlist, "dns=");
+ option_offset = 0;
+
+- while (addrs--) {
++ while (addrs-- != 0) {
+ sprint_nip6(dlist, option + 4 + option_offset);
+ dlist += 39;
+ option_offset += 16;
+- if (addrs)
++ if (addrs != 0)
+ *dlist++ = ' ';
+ }
+
+--
+2.34.1
diff --git a/package/busybox/0020-CVE-2026-29004-02.patch b/package/busybox/0020-CVE-2026-29004-02.patch
new file mode 100644
index 0000000000..c7e28abd0f
--- /dev/null
+++ b/package/busybox/0020-CVE-2026-29004-02.patch
@@ -0,0 +1,45 @@
+From 1e14c5c577a7bd46f42315e9bc445419770041a7 Mon Sep 17 00:00:00 2001
+From: Denys Vlasenko <vda.linux@googlemail.com>
+Date: Thu, 12 Mar 2026 13:23:48 +0100
+Subject: [PATCH] udhcpc6: check the size of D6_OPT_IAPREFIX option
+
+function old new delta
+option_to_env 694 711 +17
+
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+Upstream: https://github.com/vda-linux/busybox_mirror/commit/d368f3f7836d1c2484c8f839316e5c93e76d4409
+CVE: CVE-2026-29004
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ networking/udhcp/d6_dhcpc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c
+index d13b05829..1851cee2a 100644
+--- a/networking/udhcp/d6_dhcpc.c
++++ b/networking/udhcp/d6_dhcpc.c
+@@ -287,8 +287,8 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end)
+ * | valid-lifetime |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+- /* Make sure payload contains an address */
+- if (option[3] < 24)
++ /* Make sure payload exists */
++ if (option[3] < (16 + 4 + 4))
+ break;
+
+ sprint_nip6(ipv6str, option + 4);
+@@ -332,6 +332,9 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end)
+ * | |
+ * +-+-+-+-+-+-+-+-+
+ */
++ /* Make sure payload exists */
++ if (option[3] < (4 + 4 + 1 + 16))
++ break;
+ move_from_unaligned32(v32, option + 4 + 4);
+ v32 = ntohl(v32);
+ *new_env() = xasprintf("ipv6prefix_lease=%u", (unsigned)v32);
+--
+2.34.1
diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk
index d3e0678200..35dc3a52ba 100644
--- a/package/busybox/busybox.mk
+++ b/package/busybox/busybox.mk
@@ -36,6 +36,10 @@ BUSYBOX_IGNORE_CVES += CVE-2025-60876
# 0018-only-strip-unsafe-components-from-hardlinks.patch
BUSYBOX_IGNORE_CVES += CVE-2026-26157 CVE-2026-26158
+# 0019-CVE-2026-29004-01.patch
+# 0020-CVE-2026-29004-02.patch
+BUSYBOX_IGNORE_CVES += CVE-2026-29004
+
BUSYBOX_CFLAGS = \
$(TARGET_CFLAGS)
--
2.55.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [Buildroot] [PATCH 2025.02.x RESEND 1/5] package/busybox: re-introduce IGNORE_CVES for CVE-2023-42366
2026-08-11 11:42 [Buildroot] [PATCH 2025.02.x RESEND 1/5] package/busybox: re-introduce IGNORE_CVES for CVE-2023-42366 Thomas Perale via buildroot
` (3 preceding siblings ...)
2026-08-11 11:42 ` [Buildroot] [PATCH 2025.02.x RESEND 5/5] package/busybox: patch CVE-2026-29004 Thomas Perale via buildroot
@ 2026-08-22 12:07 ` Titouan Christophe via buildroot
4 siblings, 0 replies; 6+ messages in thread
From: Titouan Christophe via buildroot @ 2026-08-22 12:07 UTC (permalink / raw)
To: Thomas Perale, buildroot
On 11/08/26 13:42, Thomas Perale via buildroot wrote:
> The patch `0008-awk.c-fix-CVE-2023-42366-bug-15874.patch` was introduced
> in [1]. The IGNORE_CVES entry was removed while the patch is still
> present in [2].
>
> Re-introduce this IGNORE_CVES entry.
>
> [1] 75c594d446 package/busybox: fix pending CVEs
> [2] f88537c46b package/busybox: drop stale IGNORE_CVES entries
>
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Series applied to 2025.02.x, thanks !
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 6+ messages in thread