Heap-based buffer overflow in BusyBox - CVE-2023-42366

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU93457

Heap-based buffer overflow in BusyBox - CVE-2023-42366

Published: June 27, 2024 / Updated: April 25, 2025


Vulnerability identifier: #VU93457
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-42366
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary error within the next_token() function at awk.c. A remote attacker can trick the victim to pass a specially crafted file, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.


Affected software

BusyBox
Engineering Lifecycle Management
openEuler
Data Lakehouse
Dell Data Lakehouse
busybox-petitboot
busybox-help
busybox
busybox-debuginfo
busybox-debugsource
Cloud Pak for Network Automation

How to mitigate CVE-2023-42366

Install updates from vendor's website.

BusyBox - update to 1.37.0
Engineering Lifecycle Management - update to 1.3.0
Data Lakehouse - update to 1.3.0.0
Dell Data Lakehouse - update to 1.4.0.0
busybox-petitboot - addressed in versions 1.31.1-22, 1.34.1-20, 1.34.1-22, 1.34.1-23, 1.36.1-8
busybox-help - addressed in versions 1.31.1-22, 1.34.1-20, 1.34.1-22, 1.34.1-23, 1.36.1-8
busybox - addressed in versions 1.31.1-22, 1.34.1-20, 1.34.1-22, 1.34.1-23, 1.36.1-8
busybox-debuginfo - addressed in versions 1.31.1-22, 1.34.1-20, 1.34.1-22, 1.34.1-23, 1.36.1-8
busybox-debugsource - addressed in versions 1.31.1-22, 1.34.1-20, 1.34.1-22, 1.34.1-23, 1.36.1-8
Cloud Pak for Network Automation - update to 2.7.5

External References

Related Security Bulletins