Use-after-free in BusyBox - CVE-2023-42365

Vulnerability identifier: #VU93458

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-42365

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the copyvar() function in awk.c. A remote attacker can trick the victim to pass a specially crafted awk pattern to the application and crash it.

BusyBox
Engineering Lifecycle Management
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Data Lakehouse
Dell Data Lakehouse
busybox (Ubuntu package)
busybox-initramfs (Ubuntu package)
busybox-static (Ubuntu package)
busybox-petitboot
busybox-help
busybox-debugsource
busybox-debuginfo
busybox
busybox-tunctl
busybox-cpio
busybox-hexedit
busybox-adduser
busybox-vlan
busybox-iputils
busybox-sysvinit-tools
busybox-links
busybox-selinux-tools
busybox-unzip
busybox-util-linux
busybox-kbd
busybox-tar
busybox-hostname
busybox-syslogd
busybox-sharutils
busybox-ncurses-utils
busybox-patch
busybox-bind-utils
busybox-gawk
busybox-netcat
busybox-kmod
busybox-diffutils
busybox-sendmail
busybox-time
busybox-iproute2
busybox-bc
busybox-traceroute
busybox-grep
busybox-man
busybox-bzip2
busybox-which
busybox-net-tools
busybox-attr
busybox-xz
busybox-whois
busybox-telnet
busybox-less
busybox-sed
busybox-misc
busybox-procps
busybox-psmisc
busybox-vi
busybox-sha3sum
busybox-ed
busybox-dos2unix
busybox-gzip
busybox-udhcpc
busybox-findutils
busybox-policycoreutils
busybox-sh
busybox-tftp
busybox-wget
busybox-coreutils
busybox-warewulf3
busybox-static
busybox-testsuite
Cloud Pak for Network Automation
SmartFabric OS10

Install updates from vendor's website.

BusyBox - update to 1.37.0
Engineering Lifecycle Management - update to 1.3.0
Data Lakehouse - update to 1.3.0.0
Dell Data Lakehouse - update to 1.4.0.0
busybox (Ubuntu package) - addressed in versions 1:1.30.1-4ubuntu6.5, 1:1.30.1-7ubuntu3.1, 1:1.36.1-6ubuntu3.1, 1:1.36.1-6ubuntu4
busybox-initramfs (Ubuntu package) - addressed in versions 1:1.30.1-4ubuntu6.5, 1:1.30.1-7ubuntu3.1, 1:1.36.1-6ubuntu3.1, 1:1.36.1-6ubuntu4
busybox-static (Ubuntu package) - addressed in versions 1:1.30.1-4ubuntu6.5, 1:1.30.1-7ubuntu3.1, 1:1.36.1-6ubuntu3.1, 1:1.36.1-6ubuntu4
busybox-petitboot - addressed in versions 1.31.1-23, 1.34.1-20, 1.34.1-23, 1.36.1-8
busybox-help - addressed in versions 1.31.1-23, 1.34.1-20, 1.34.1-23, 1.36.1-8
busybox-debugsource - addressed in versions 1.31.1-23, 1.34.1-20, 1.34.1-23, 1.36.1-8
busybox-debuginfo - addressed in versions 1.31.1-23, 1.34.1-20, 1.34.1-23, 1.36.1-8
busybox - addressed in versions 1.31.1-23, 1.34.1-20, 1.34.1-23, 1.36.1-8
busybox-tunctl - update to 1.37.0-150500.7.7.2
busybox-cpio - update to 1.37.0-150500.7.7.2
busybox-hexedit - update to 1.37.0-150500.7.7.2
busybox-adduser - update to 1.37.0-150500.7.7.2
busybox-vlan - update to 1.37.0-150500.7.7.2
busybox-iputils - update to 1.37.0-150500.7.7.2
busybox-sysvinit-tools - update to 1.37.0-150500.7.7.2
busybox-links - update to 1.37.0-150500.7.7.2
busybox-selinux-tools - update to 1.37.0-150500.7.7.2
busybox-unzip - update to 1.37.0-150500.7.7.2
busybox-util-linux - update to 1.37.0-150500.7.7.2
busybox-kbd - update to 1.37.0-150500.7.7.2
busybox-tar - update to 1.37.0-150500.7.7.2
busybox-hostname - update to 1.37.0-150500.7.7.2
busybox-syslogd - update to 1.37.0-150500.7.7.2
busybox-sharutils - update to 1.37.0-150500.7.7.2
busybox-ncurses-utils - update to 1.37.0-150500.7.7.2
busybox-patch - update to 1.37.0-150500.7.7.2
busybox-bind-utils - update to 1.37.0-150500.7.7.2
busybox-gawk - update to 1.37.0-150500.7.7.2
busybox-netcat - update to 1.37.0-150500.7.7.2
busybox-kmod - update to 1.37.0-150500.7.7.2
busybox-diffutils - update to 1.37.0-150500.7.7.2
busybox-sendmail - update to 1.37.0-150500.7.7.2
busybox-time - update to 1.37.0-150500.7.7.2
busybox-iproute2 - update to 1.37.0-150500.7.7.2
busybox-bc - update to 1.37.0-150500.7.7.2
busybox-traceroute - update to 1.37.0-150500.7.7.2
busybox-grep - update to 1.37.0-150500.7.7.2
busybox-man - update to 1.37.0-150500.7.7.2
busybox-bzip2 - update to 1.37.0-150500.7.7.2
busybox-which - update to 1.37.0-150500.7.7.2
busybox-net-tools - update to 1.37.0-150500.7.7.2
busybox-attr - update to 1.37.0-150500.7.7.2
busybox-xz - update to 1.37.0-150500.7.7.2
busybox-whois - update to 1.37.0-150500.7.7.2
busybox-telnet - update to 1.37.0-150500.7.7.2
busybox-less - update to 1.37.0-150500.7.7.2
busybox-sed - update to 1.37.0-150500.7.7.2
busybox-misc - update to 1.37.0-150500.7.7.2
busybox-procps - update to 1.37.0-150500.7.7.2
busybox-psmisc - update to 1.37.0-150500.7.7.2
busybox-vi - update to 1.37.0-150500.7.7.2
busybox-sha3sum - update to 1.37.0-150500.7.7.2
busybox-ed - update to 1.37.0-150500.7.7.2
busybox-dos2unix - update to 1.37.0-150500.7.7.2
busybox-gzip - update to 1.37.0-150500.7.7.2
busybox-udhcpc - update to 1.37.0-150500.7.7.2
busybox-findutils - update to 1.37.0-150500.7.7.2
busybox-policycoreutils - update to 1.37.0-150500.7.7.2
busybox-sh - update to 1.37.0-150500.7.7.2
busybox-tftp - update to 1.37.0-150500.7.7.2
busybox-wget - update to 1.37.0-150500.7.7.2
busybox-coreutils - update to 1.37.0-150500.7.7.2
busybox-warewulf3 - update to 1.37.0-150500.10.11.1
busybox-static - addressed in versions 1.37.0-150500.10.11.1, 1.37.0-150700.18.4.1
busybox-testsuite - update to 1.37.0-150500.10.11.1
busybox - addressed in versions 1.37.0-150500.10.11.1, 1.37.0-150700.18.4.1
Cloud Pak for Network Automation - update to 2.7.5
SmartFabric OS10 - addressed in versions 10.5.4.15, 10.5.5.14, 10.5.6.9

• https://bugs.busybox.net/show_bug.cgi?id=15871

• Multiple vulnerabilities in BusyBox
• openEuler 22.03 LTS SP1 update for busybox
• Ubuntu update for busybox
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• openEuler 20.03 LTS SP4 update for busybox
• openEuler 22.03 LTS SP3 update for busybox
• openEuler 22.03 LTS SP4 update for busybox
• openEuler 24.03 LTS update for busybox
• Dell Data Lakehouse System software update for third-party components
• Multiple vulnerabilities in Dell SmartFabric OS10
• Dell SmartFabric OS10 update for third-party components
• Dell Data Lakehouse update for third-party components
• Dell Networking OS10 update for third-party components
• SUSE update for busybox, busybox-links
• SUSE update for busybox, busybox-links
• SUSE update for busybox, busybox-links
• Multiple vulnerabilities in IBM Engineering Lifecycle Management on Hybrid Cloud