Use-after-free in BusyBox - CVE-2023-42363

Vulnerability identifier: #VU93460

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-42363

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the xasprintf() function in xfuncs_printf.c. A remote attacker can trick the victim to pass a specially crafted input to the application and crash it.

BusyBox
Engineering Lifecycle Management
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Data Lakehouse
Dell Data Lakehouse
busybox-static (Ubuntu package)
busybox-initramfs (Ubuntu package)
busybox (Ubuntu package)
busybox
busybox-debuginfo
busybox-debugsource
busybox-help
busybox-petitboot
busybox-kmod
busybox-sysvinit-tools
busybox-iputils
busybox-vlan
busybox-adduser
busybox-hexedit
busybox-tunctl
busybox-syslogd
busybox-sharutils
busybox-ncurses-utils
busybox-patch
busybox-bind-utils
busybox-gawk
busybox-netcat
busybox-links
busybox-diffutils
busybox-sendmail
busybox-time
busybox-iproute2
busybox-bc
busybox-whois
busybox-xz
busybox-attr
busybox-net-tools
busybox-which
busybox-bzip2
busybox-man
busybox-findutils
busybox-telnet
busybox-less
busybox-sed
busybox-misc
busybox-procps
busybox-traceroute
busybox-psmisc
busybox-vi
busybox-sha3sum
busybox-ed
busybox-dos2unix
busybox-gzip
busybox-udhcpc
busybox-hostname
busybox-policycoreutils
busybox-sh
busybox-tftp
busybox-wget
busybox-coreutils
busybox-cpio
busybox-tar
busybox-kbd
busybox-util-linux
busybox-unzip
busybox-selinux-tools
busybox-grep
busybox-static
busybox-testsuite
busybox-warewulf3
Cloud Pak for Network Automation

Install updates from vendor's website.

BusyBox - update to 1.37.0
Engineering Lifecycle Management - update to 1.3.0
Data Lakehouse - update to 1.3.0.0
Dell Data Lakehouse - update to 1.4.0.0
busybox-static (Ubuntu package) - addressed in versions 1:1.30.1-4ubuntu6.5, 1:1.30.1-7ubuntu3.1, 1:1.36.1-6ubuntu3.1, 1:1.36.1-6ubuntu4
busybox-initramfs (Ubuntu package) - addressed in versions 1:1.30.1-4ubuntu6.5, 1:1.30.1-7ubuntu3.1, 1:1.36.1-6ubuntu3.1, 1:1.36.1-6ubuntu4
busybox (Ubuntu package) - addressed in versions 1:1.30.1-4ubuntu6.5, 1:1.30.1-7ubuntu3.1, 1:1.36.1-6ubuntu3.1, 1:1.36.1-6ubuntu4
busybox - addressed in versions 1.31.1-22, 1.34.1-20, 1.34.1-21, 1.34.1-22, 1.36.1-6
busybox-debuginfo - addressed in versions 1.31.1-22, 1.34.1-20, 1.34.1-21, 1.34.1-22, 1.36.1-6
busybox-debugsource - addressed in versions 1.31.1-22, 1.34.1-20, 1.34.1-21, 1.34.1-22, 1.36.1-6
busybox-help - addressed in versions 1.31.1-22, 1.34.1-20, 1.34.1-21, 1.34.1-22, 1.36.1-6
busybox-petitboot - addressed in versions 1.31.1-22, 1.34.1-20, 1.34.1-21, 1.34.1-22, 1.36.1-6
busybox-kmod - update to 1.37.0-150500.7.7.2
busybox-sysvinit-tools - update to 1.37.0-150500.7.7.2
busybox-iputils - update to 1.37.0-150500.7.7.2
busybox-vlan - update to 1.37.0-150500.7.7.2
busybox-adduser - update to 1.37.0-150500.7.7.2
busybox-hexedit - update to 1.37.0-150500.7.7.2
busybox-tunctl - update to 1.37.0-150500.7.7.2
busybox-syslogd - update to 1.37.0-150500.7.7.2
busybox-sharutils - update to 1.37.0-150500.7.7.2
busybox-ncurses-utils - update to 1.37.0-150500.7.7.2
busybox-patch - update to 1.37.0-150500.7.7.2
busybox-bind-utils - update to 1.37.0-150500.7.7.2
busybox-gawk - update to 1.37.0-150500.7.7.2
busybox-netcat - update to 1.37.0-150500.7.7.2
busybox-links - update to 1.37.0-150500.7.7.2
busybox-diffutils - update to 1.37.0-150500.7.7.2
busybox-sendmail - update to 1.37.0-150500.7.7.2
busybox-time - update to 1.37.0-150500.7.7.2
busybox-iproute2 - update to 1.37.0-150500.7.7.2
busybox-bc - update to 1.37.0-150500.7.7.2
busybox-whois - update to 1.37.0-150500.7.7.2
busybox-xz - update to 1.37.0-150500.7.7.2
busybox-attr - update to 1.37.0-150500.7.7.2
busybox-net-tools - update to 1.37.0-150500.7.7.2
busybox-which - update to 1.37.0-150500.7.7.2
busybox-bzip2 - update to 1.37.0-150500.7.7.2
busybox-man - update to 1.37.0-150500.7.7.2
busybox-findutils - update to 1.37.0-150500.7.7.2
busybox-telnet - update to 1.37.0-150500.7.7.2
busybox-less - update to 1.37.0-150500.7.7.2
busybox-sed - update to 1.37.0-150500.7.7.2
busybox-misc - update to 1.37.0-150500.7.7.2
busybox-procps - update to 1.37.0-150500.7.7.2
busybox-traceroute - update to 1.37.0-150500.7.7.2
busybox-psmisc - update to 1.37.0-150500.7.7.2
busybox-vi - update to 1.37.0-150500.7.7.2
busybox-sha3sum - update to 1.37.0-150500.7.7.2
busybox-ed - update to 1.37.0-150500.7.7.2
busybox-dos2unix - update to 1.37.0-150500.7.7.2
busybox-gzip - update to 1.37.0-150500.7.7.2
busybox-udhcpc - update to 1.37.0-150500.7.7.2
busybox-hostname - update to 1.37.0-150500.7.7.2
busybox-policycoreutils - update to 1.37.0-150500.7.7.2
busybox-sh - update to 1.37.0-150500.7.7.2
busybox-tftp - update to 1.37.0-150500.7.7.2
busybox-wget - update to 1.37.0-150500.7.7.2
busybox-coreutils - update to 1.37.0-150500.7.7.2
busybox-cpio - update to 1.37.0-150500.7.7.2
busybox-tar - update to 1.37.0-150500.7.7.2
busybox-kbd - update to 1.37.0-150500.7.7.2
busybox-util-linux - update to 1.37.0-150500.7.7.2
busybox-unzip - update to 1.37.0-150500.7.7.2
busybox-selinux-tools - update to 1.37.0-150500.7.7.2
busybox-grep - update to 1.37.0-150500.7.7.2
busybox - addressed in versions 1.37.0-150500.10.11.1, 1.37.0-150700.18.4.1
busybox-static - addressed in versions 1.37.0-150500.10.11.1, 1.37.0-150700.18.4.1
busybox-testsuite - update to 1.37.0-150500.10.11.1
busybox-warewulf3 - update to 1.37.0-150500.10.11.1
Cloud Pak for Network Automation - update to 2.7.5

• https://bugs.busybox.net/show_bug.cgi?id=15865

• Multiple vulnerabilities in BusyBox
• openEuler 22.03 LTS SP1 update for busybox
• openEuler 22.03 LTS SP3 update for busybox
• openEuler 20.03 LTS SP4 update for busybox
• openEuler 24.03 LTS update for busybox
• openEuler 22.03 LTS SP4 update for busybox
• Ubuntu update for busybox
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Dell Data Lakehouse System software update for third-party components
• Dell Data Lakehouse update for third-party components
• SUSE update for busybox, busybox-links
• SUSE update for busybox, busybox-links
• SUSE update for busybox, busybox-links
• Multiple vulnerabilities in IBM Engineering Lifecycle Management on Hybrid Cloud