Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package busybox for openSUSE:Factory checked in at 2026-11-01 22:22:36 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/busybox (Old) and /work/SRC/openSUSE:Factory/.busybox.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "busybox" Sun Nov 1 22:22:36 2026 rev:101 rq:1393843 version:1.38.0 Changes: -------- --- /work/SRC/openSUSE:Factory/busybox/busybox.changes 2026-10-02 23:02:57.836338968 +0200 +++ /work/SRC/openSUSE:Factory/.busybox.new.1255/busybox.changes 2026-11-01 22:23:14.731567036 +0100 @@ -1,0 +2,38 @@ +Fri Oct 30 08:33:50 UTC 2026 - Radoslav Kolev <[email protected]> + +- Note we are not affected by the following CVEs with no fixes upstream. + The relevant applets are disabled in our config. Add comments to the + config file warning that enabling them would expose the unfixed CVEs: + * dpkg-deb extraction-root escape via per-ar-member deferred + symlink flush, CONFIG_DPKG disabled + (CVE-2026-90954, bsc#1285581) + * dpkg stale field_start pointer causing out-of-bounds read and + status file corruption, CONFIG_DPKG disabled + (CVE-2026-88842, bsc#1285579) + * HTTP request smuggling via pipelined requests in httpd reverse + proxy, CONFIG_FEATURE_HTTPD_PROXY disabled + (CVE-2026-88829, bsc#1285577) + +------------------------------------------------------------------- +Fri Oct 30 08:06:02 UTC 2026 - Radoslav Kolev <[email protected]> + +- Fix denial of service via terminal escape sequences in process + names displayed by netstat (CVE-2024-58251, bsc#1241700) + * 0001-Fix-CVE-2024-58251-sanitize-process-names-when-calli.patch +- Fix tar extraction-root escape via deferred symlink/hardlink + creation (CVE-2026-108119, bsc#1284987) + * 0001-tar-protect-against-Symlink-Hardlink-attack.patch +- Fix integer underflow in udhcpc d4_recv_raw_packet() leading to + a crash when processing short untrusted DHCP packets + (CVE-2026-88833, bsc#1285315) + * 0001-udhcpc-ensure-packet.data.cookie-exists-before-we-ac.patch +- Fix httpd authentication timing difference between existing and + non-existing system users caused by a missing else clause after + a failed getspnam_r() call (CVE-2026-88834, bsc#1285314) + * 0001-httpd-do-not-try-to-use-obviously-bogus-password-fro.patch +- Fix path traversal in libarchive allowing a crafted archive with + a ".." member name to create files outside the extraction + directory (CVE-2026-92205, bsc#1286932) + * 0001-tar-.-is-also-an-unsafe-filename-treat-as-such.patch + +------------------------------------------------------------------- New: ---- 0001-Fix-CVE-2024-58251-sanitize-process-names-when-calli.patch 0001-httpd-do-not-try-to-use-obviously-bogus-password-fro.patch 0001-tar-.-is-also-an-unsafe-filename-treat-as-such.patch 0001-tar-protect-against-Symlink-Hardlink-attack.patch 0001-udhcpc-ensure-packet.data.cookie-exists-before-we-ac.patch ----------(New B)---------- New: names displayed by netstat (CVE-2024-58251, bsc#1241700) * 0001-Fix-CVE-2024-58251-sanitize-process-names-when-calli.patch - Fix tar extraction-root escape via deferred symlink/hardlink New: a failed getspnam_r() call (CVE-2026-88834, bsc#1285314) * 0001-httpd-do-not-try-to-use-obviously-bogus-password-fro.patch - Fix path traversal in libarchive allowing a crafted archive with New: directory (CVE-2026-92205, bsc#1286932) * 0001-tar-.-is-also-an-unsafe-filename-treat-as-such.patch New: creation (CVE-2026-108119, bsc#1284987) * 0001-tar-protect-against-Symlink-Hardlink-attack.patch - Fix integer underflow in udhcpc d4_recv_raw_packet() leading to New: (CVE-2026-88833, bsc#1285315) * 0001-udhcpc-ensure-packet.data.cookie-exists-before-we-ac.patch - Fix httpd authentication timing difference between existing and ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ busybox.spec ++++++ --- /var/tmp/diff_new_pack.hG8Q6D/_old 2026-11-01 22:23:16.652646629 +0100 +++ /var/tmp/diff_new_pack.hG8Q6D/_new 2026-11-01 22:23:16.654646712 +0100 @@ -79,6 +79,16 @@ Patch20: 0001-httpd-allow-yescrypt-passwords-y.patch # PATCH-FIX-UPSTREAM - Fix bsc#1282568 (CVE-2026-88839), passwd/group parser OOB write on stale tokenize() endpoint (upstream commit c2dec52d3) Patch21: 0001-libpwdgrp-tokenizer-fix-for-trailing-whitespace-remo.patch +# PATCH-FIX-UPSTREAM - Fix bsc#1241700 (CVE-2024-58251), DoS via terminal escape sequences in netstat process names +Patch22: 0001-Fix-CVE-2024-58251-sanitize-process-names-when-calli.patch +# PATCH-FIX-UPSTREAM - Fix bsc#1284987 (CVE-2026-108119), tar extraction-root escape via deferred symlink/hardlink creation (upstream commit 382008b3f) +Patch23: 0001-tar-protect-against-Symlink-Hardlink-attack.patch +# PATCH-FIX-UPSTREAM - Fix bsc#1285315 (CVE-2026-88833), integer underflow in udhcpc d4_recv_raw_packet() on short DHCP packets (upstream commit fd1972099) +Patch24: 0001-udhcpc-ensure-packet.data.cookie-exists-before-we-ac.patch +# PATCH-FIX-UPSTREAM - Fix bsc#1285314 (CVE-2026-88834), httpd user enumeration via missing else after failed getspnam_r() (upstream commit b829bba95) +Patch25: 0001-httpd-do-not-try-to-use-obviously-bogus-password-fro.patch +# PATCH-FIX-UPSTREAM - Fix bsc#1286932 (CVE-2026-92205), libarchive path traversal via ".." filename (upstream commit 5da20102b) +Patch26: 0001-tar-.-is-also-an-unsafe-filename-treat-as-such.patch # other patches Patch100: busybox.install.patch ++++++ 0001-Fix-CVE-2024-58251-sanitize-process-names-when-calli.patch ++++++ >From 75bd9ecec771d48741325a8e9c2b6fd036ae115a Mon Sep 17 00:00:00 2001 From: Kyle Steere <[email protected]> Date: Thu, 21 Aug 2025 01:14:56 -0500 Subject: [PATCH] Fix CVE-2024-58251 - sanitize process names when calling netstat In BusyBox netstat, local users can launch a network application with an argv[0] containing ANSI terminal escape sequences, leading to a denial of service (terminal locked up) when netstat is used by a victim. This patch sanitizes the process name before storing it in the cache, replacing any non-printable characters (including escape sequences) with '?'. CVE-2024-58251: https://nvd.nist.gov/vuln/detail/CVE-2024-58251 --- networking/netstat.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/networking/netstat.c b/networking/netstat.c index d31928957..b87e19c9f 100644 --- a/networking/netstat.c +++ b/networking/netstat.c @@ -317,7 +317,11 @@ static int FAST_FUNC dir_act(struct recursive_state *state, /* go through all files in /proc/PID/fd and check whether they are sockets */ strcpy(proc_pid_fname + len - (sizeof("cmdline")-1), "fd"); - pid_slash_progname = concat_path_file(pid, bb_basename(cmdline_buf)); /* "PID/argv0" */ + + /* Sanitize the program name to prevent ANSI escape sequences (CVE-2024-58251) */ + /* printable_string() returns a string with non-printable chars replaced by '?' */ + const char *sanitized_name = printable_string(bb_basename(cmdline_buf)); + pid_slash_progname = concat_path_file(pid, sanitized_name); /* "PID/argv0" */ n = recursive_action(proc_pid_fname, ACTION_RECURSE | ACTION_QUIET, add_to_prg_cache_if_socket, ++++++ 0001-httpd-do-not-try-to-use-obviously-bogus-password-fro.patch ++++++ >From b829bba95095b87834628adb38ea14b5885c0fbc Mon Sep 17 00:00:00 2001 From: Denys Vlasenko <[email protected]> Date: Mon, 5 Oct 2026 22:59:11 +0200 Subject: [PATCH] httpd: do not try to use obviously bogus password from /etc/passwd If password is 'x' or '*' and yet, /etc/shadow has no entry, do not run the crypt machinery - go to the next entry. function old new delta check_user_passwd 444 462 +18 Signed-off-by: Denys Vlasenko <[email protected]> --- networking/httpd.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/networking/httpd.c b/networking/httpd.c index 7469de1de..a6daba044 100644 --- a/networking/httpd.c +++ b/networking/httpd.c @@ -2181,7 +2181,6 @@ static int check_user_passwd(const char *path, char *user_and_passwd) # if ENABLE_FEATURE_SHADOWPASSWDS && !ENABLE_PAM char sp_buf[256]; # endif - colon_after_user = strchr(user_and_passwd, ':'); if (!colon_after_user) goto bad_input; @@ -2236,8 +2235,9 @@ static int check_user_passwd(const char *path, char *user_and_passwd) * At least glibc 2.4 does this. Be extra paranoid here. */ struct spwd *result = NULL; r = getspnam_r(pw->pw_name, &spw, sp_buf, sizeof(sp_buf), &result); - if (r == 0 && result) - passwd = result->sp_pwdp; + if (r != 0 || !result) + continue; /* no shadow, and passwd entry is bogus one-char string */ + passwd = result->sp_pwdp; } # endif /* In this case, passwd is ALWAYS encrypted: @@ -2250,9 +2250,7 @@ static int check_user_passwd(const char *path, char *user_and_passwd) if (passwd[0] == '$' && (isdigit(passwd[1]) || passwd[1] == 'y')) { char *encrypted; -# if !ENABLE_PAM - check_encrypted: -# endif + IF_NOT_PAM(check_encrypted:) /* encrypt pwd from peer and check match with local one */ encrypted = pw_encrypt( /* pwd (from peer): */ colon_after_user + 1, -- 2.52.0 ++++++ 0001-tar-.-is-also-an-unsafe-filename-treat-as-such.patch ++++++ >From 5da20102b5db249c76edddd2cf608394a1ad34dc Mon Sep 17 00:00:00 2001 From: Denys Vlasenko <[email protected]> Date: Fri, 9 Oct 2026 15:09:26 +0200 Subject: [PATCH] tar: ".." is also an unsafe filename, treat as such Signed-off-by: Denys Vlasenko <[email protected]> --- archival/libarchive/unsafe_prefix.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c index 89a371a7f..ab70ff816 100644 --- a/archival/libarchive/unsafe_prefix.c +++ b/archival/libarchive/unsafe_prefix.c @@ -8,6 +8,12 @@ const char* FAST_FUNC skip_unsafe_prefix(const char *str) { const char *cp = str; + + /* if "..": malicious, return "" */ + /* (causes harmless errors trying to create or hardlink a file named "") */ + if (cp[0] == '.' && cp[1] == '.' && cp[2] == '\0') + return cp + 2; + while (1) { const char *cp2; if (*cp == '/') { -- 2.52.0 ++++++ 0001-tar-protect-against-Symlink-Hardlink-attack.patch ++++++ >From 382008b3f07d78e3abbc50d00bb857622dbbfac6 Mon Sep 17 00:00:00 2001 From: Denys Vlasenko <[email protected]> Date: Fri, 9 Oct 2026 16:37:30 +0200 Subject: [PATCH] tar: protect against Symlink+Hardlink attack function old new delta create_links_from_list 93 190 +97 Signed-off-by: Denys Vlasenko <[email protected]> --- archival/libarchive/unsafe_symlink_target.c | 54 ++++++++++++++++++--- testsuite/tar.tests | 39 +++++++++++++-- 2 files changed, 81 insertions(+), 12 deletions(-) diff --git a/archival/libarchive/unsafe_symlink_target.c b/archival/libarchive/unsafe_symlink_target.c index d764c89ab..65c782bdd 100644 --- a/archival/libarchive/unsafe_symlink_target.c +++ b/archival/libarchive/unsafe_symlink_target.c @@ -17,26 +17,64 @@ void FAST_FUNC create_or_remember_link(llist_t **link_placeholders, return; } if (symlink(target, linkname) != 0) { - /* shared message */ + // shared message bb_perror_msg_and_die("can't create %slink '%s' to '%s'", "sym", linkname, target ); } } +static int all_dir_components_are_dirs(char *path) +{ + struct stat sb; + char *slash; + + slash = path; + while ((slash = strchr(slash, '/')) != NULL) { + int ok; + *slash = '\0'; + ok = (lstat(path, &sb) == 0 && S_ISDIR(sb.st_mode)); + *slash++ = '/'; + if (!ok) + return 0; + } + return 1; +} + void FAST_FUNC create_links_from_list(llist_t *list) { + // This idea sounds better (fewer file ops): + // Create hardlinks first, then symlinks. + // ^^^ but it breaks the "hardlink to symlink" case: + // mkdir dir + // >dir/a + // ln -s ../dir/a dir/b + // ln dir/b dir/c + // mkdir new; tar cf - dir/a dir/b dir/c | tar -C new -xvf - + // On extract, 'c' will have no 'b' to be a hardlink to. + while (list) { char *target; + char *linkname = list->data + 1; - target = list->data + 1 + strlen(list->data + 1) + 1; - if ((*list->data ? link : symlink) (target, list->data + 1)) { - /* shared message */ - bb_error_msg_and_die("can't create %slink '%s' to '%s'", - *list->data ? "hard" : "sym", - list->data + 1, target + target = linkname + strlen(linkname) + 1; + + // Check whether the linkname has suspicious components: + // SYMLINK_OUTSIDE_EXTRACT_DIR/etc/passwd sort of thing. + // (Our delayed creation of symlinks is not defending against it, + // we could create SYMLINK_OUTSIDE_EXTRACT_DIR ourself!) + if (!all_dir_components_are_dirs(linkname)) { + errno = ENOTDIR; + goto err; + } + if ((list->data[0] ? link : symlink) (target, linkname)) { + // shared message + err: + bb_perror_msg_and_die("can't create %slink '%s' to '%s'", + list->data[0] ? "hard" : "sym", + linkname, target ); - /* Note: GNU tar 1.34 errors out only _after_ all links are (attempted to be) created */ + // Note: GNU tar 1.34 errors out only _after_ all links are (attempted to be) created } list = list->link; } diff --git a/testsuite/tar.tests b/testsuite/tar.tests index 83c8c2edf..efd8f4855 100755 --- a/testsuite/tar.tests +++ b/testsuite/tar.tests @@ -304,7 +304,7 @@ optional UUDECODE FEATURE_TAR_AUTODETECT FEATURE_SEAMLESS_BZ2 testing "tar does not extract into symlinks" "\ >>/tmp/passwd && uudecode -o input && tar xf input 2>&1 && rm passwd; cat >>/tmp/passwd; echo \$? " "\ -tar: can't create symlink 'passwd' to '/tmp/passwd' +tar: can't create symlink 'passwd' to '/tmp/passwd': File exists 0 " \ "" "\ @@ -324,7 +324,7 @@ optional UUDECODE FEATURE_TAR_AUTODETECT FEATURE_SEAMLESS_BZ2 testing "tar -k does not extract into symlinks" "\ >>/tmp/passwd && uudecode -o input && tar xf input -k 2>&1 && rm passwd; cat >>/tmp/passwd; echo \$? " "\ -tar: can't create symlink 'passwd' to '/tmp/passwd' +tar: can't create symlink 'passwd' to '/tmp/passwd': File exists 0 " \ "" "\ @@ -374,7 +374,7 @@ ls symlink/bb_test_evilfile anything.txt symlink symlink/bb_test_evilfile -tar: can't create symlink 'symlink' to '/tmp' +tar: can't create symlink 'symlink' to '/tmp': File exists 1 ls: /tmp/bb_test_evilfile: No such file or directory ls: bb_test_evilfile: No such file or directory @@ -400,7 +400,7 @@ mkdir dir ln -s ../dir/a dir/b ln dir/b dir/c mkdir new -tar cf - dir/* | tar -C new -xvf - 2>&1 +tar cf - dir/a dir/b dir/c | tar -C new -xvf - 2>&1 ' "\ dir/a dir/b @@ -410,4 +410,35 @@ dir/c SKIP= cd .. || exit 1; rm -rf tar.tempdir 2>/dev/null +mkdir tar.tempdir && cd tar.tempdir || exit 1 +testing "tar Symlink+Hardlink attack: create symlink-to-outside and then create a hardlink in it" '\ +exec 2>&1 +mkdir 2tar || exit 1 +( +cd 2tar || exit 1 +ln -s .. gate +ln -s gate alias +ln -s alias portal + > seed +ln seed portal/ESCAPED +#^^^ the ESCAPED file is actually in ..! +tar cf 2tar.tar \ + alias \ + gate \ + portal \ + seed \ + portal/ESCAPED +rm portal/ESCAPED alias gate portal seed +tar xf 2tar.tar +echo $? +) +test -e ESCAPED && echo "ESCAPED!" +' "\ +tar: can't create directory 'portal': No such file or directory +tar: can't create hardlink 'portal/ESCAPED' to 'seed': Not a directory +1 +" \ +"" "" +cd .. || exit 1; rm -rf tar.tempdir 2>/dev/null + exit $FAILCOUNT -- 2.52.0 ++++++ 0001-udhcpc-ensure-packet.data.cookie-exists-before-we-ac.patch ++++++ >From fd1972099f28636b5deea200022b528f3a0bd523 Mon Sep 17 00:00:00 2001 From: Denys Vlasenko <[email protected]> Date: Mon, 21 Sep 2026 12:15:19 +0200 Subject: [PATCH] udhcpc: ensure packet.data.cookie exists before we access it function old new delta d4_recv_raw_packet 497 500 +3 Signed-off-by: Denys Vlasenko <[email protected]> --- networking/udhcp/dhcpc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c index e44086c2e..936687e13 100644 --- a/networking/udhcp/dhcpc.c +++ b/networking/udhcp/dhcpc.c @@ -900,7 +900,12 @@ static NOINLINE int d4_recv_raw_packet(struct dhcp_packet *dhcp_pkt, int fd) break; } - if (bytes < (int) (sizeof(packet.ip) + sizeof(packet.udp))) { + if (bytes < (int) ( + sizeof(packet.ip) + sizeof(packet.udp) + + offsetof(struct dhcp_packet, options) + /* DHCP requires option 255 is always present, IOW: at least one byte in options[]: */ + + 1 + )) { log1s("packet is too short, ignoring"); return -2; } @@ -954,7 +959,7 @@ static NOINLINE int d4_recv_raw_packet(struct dhcp_packet *dhcp_pkt, int fd) packet.ip.tot_len = packet.udp.len; /* yes, this is needed */ check = packet.udp.check; packet.udp.check = 0; - if (check && check != inet_cksum(&packet, bytes)) { + if (check != 0 && check != inet_cksum(&packet, bytes)) { log1s("packet with bad UDP checksum, ignoring"); return -2; } -- 2.52.0 ++++++ busybox.config ++++++ --- /var/tmp/diff_new_pack.hG8Q6D/_old 2026-11-01 22:23:16.822653672 +0100 +++ /var/tmp/diff_new_pack.hG8Q6D/_new 2026-11-01 22:23:16.827653879 +0100 @@ -166,6 +166,8 @@ CONFIG_FEATURE_CPIO_P=y CONFIG_FEATURE_CPIO_IGNORE_DEVNO=y CONFIG_FEATURE_CPIO_RENUMBER_INODES=y +# WARNING: enabling CONFIG_DPKG or CONFIG_DPKG_DEB exposes unfixed CVE-2026-88842 (bsc#1285579) +# WARNING: enabling CONFIG_DPKG or CONFIG_DPKG_DEB exposes unfixed CVE-2026-90954 (bsc#1285581) # CONFIG_DPKG is not set # CONFIG_DPKG_DEB is not set CONFIG_GZIP=y @@ -904,6 +906,7 @@ # CONFIG_FEATURE_HTTPD_SET_REMOTE_PORT_TO_ENV is not set # CONFIG_FEATURE_HTTPD_ENCODE_URL_STR is not set # CONFIG_FEATURE_HTTPD_ERROR_PAGES is not set +# WARNING: enabling CONFIG_FEATURE_HTTPD_PROXY exposes unfixed CVE-2026-88829 (bsc#1285577) # CONFIG_FEATURE_HTTPD_PROXY is not set # CONFIG_FEATURE_HTTPD_GZIP is not set # CONFIG_FEATURE_HTTPD_ETAG is not set
