CVE-2021-28831

decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.

decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.(CVE-2021-28831)

decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.

• SECURITY UPDATE: operation on invalid pointer
  • debian/patches/CVE-2021-28831.patch: decompress_gunzip.c mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.
  • CVE-2021-28831

Updated busybox packages fix security vulnerability:

decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data (CVE-2021-28831).

This update for busybox fixes the following issues:

• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
• CVE-2018-1000517: Fixed buffer overflow in the retrieve_file_data() (bsc#1099260).
• CVE-2011-5325: Fixed a directory traversal related to 'tar' command (bsc#951562).
• CVE-2018-1000500: Fixed missing SSL certificate validation related to the 'wget' command (bsc#1099263).

This update was imported from the SUSE:SLE-15:Update update project.

This update for busybox fixes the following issues:

• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
• CVE-2018-1000517: Fixed buffer overflow in the retrieve_file_data() (bsc#1099260).
• CVE-2011-5325: Fixed a directory traversal related to 'tar' command (bsc#951562).
• CVE-2018-1000500: Fixed missing SSL certificate validation related to the 'wget' command (bsc#1099263).

This update for busybox fixes the following issues:

• CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
• CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).
• CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
• CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
• CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
• CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
• CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).
• CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).
• CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).
• CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
• CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
• CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).
• CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).
• CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).
• CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).
• CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).
• CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).
• CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).
• CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).
• CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).
• CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).
• CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).
• CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).

These are all security issues fixed in the busybox-1.35.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for busybox fixes the following issues:

• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
• CVE-2018-1000517: Fixed buffer overflow in the retrieve_file_data() (bsc#1099260).
• CVE-2011-5325: Fixed a directory traversal related to 'tar' command (bsc#951562).
• CVE-2018-1000500: Fixed missing SSL certificate validation related to the 'wget' command (bsc#1099263).

This update for busybox fixes the following issues:

• CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
• CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).
• CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
• CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
• CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
• CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
• CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).
• CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).
• CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).
• CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
• CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
• CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).
• CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).
• CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).
• CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).
• CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).
• CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).
• CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).
• CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).
• CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).
• CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).
• CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).
• CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).

This update for busybox fixes the following issues:

• CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
• CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).
• CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
• CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
• CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
• CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
• CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).
• CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).
• CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).
• CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
• CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
• CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).
• CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).
• CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).
• CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).
• CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).
• CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).
• CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).
• CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).
• CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).
• CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).
• CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).
• CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).

This update for busybox fixes the following issues:

• Enable switch_root With this change virtme --force-initramfs works as expected.
• Enable udhcpc

busybox was updated to 1.35.0

• Adjust busybox.config for new features in find, date and cpio

• Annotate CVEs already fixed in upstream, but not mentioned in .changes yet:

• CVE-2017-16544 (bsc#1069412): Insufficient sanitization of filenames when autocompleting
• CVE-2015-9261 (bsc#1102912): huft_build misuses a pointer, causing segfaults
• CVE-2016-2147 (bsc#970663): out of bounds write (heap) due to integer underflow in udhcpc
• CVE-2016-2148 (bsc#970662): heap-based buffer overflow in OPTION_6RD parsing
• CVE-2016-6301 (bsc#991940): NTP server denial of service flaw
• CVE-2017-15873 (bsc#1064976): The get_next_block function in archival/libarchive/decompress_bunzip2.c has an Integer Overflow
• CVE-2017-15874 (bsc#1064978): archival/libarchive/decompress_unlzma.c has an Integer Underflow
• CVE-2019-5747 (bsc#1121428): out of bounds read in udhcp components
• CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386 (bsc#1192869) : v1.34.0 bugfixes
• CVE-2021-28831 (bsc#1184522): invalid free or segmentation fault via malformed gzip data
• CVE-2018-20679 (bsc#1121426): out of bounds read in udhcp
• CVE-2018-1000517 (bsc#1099260): Heap-based buffer overflow in the retrieve_file_data()
• CVE-2011-5325 (bsc#951562): tar directory traversal
• CVE-2018-1000500 (bsc#1099263): wget: Missing SSL certificate validation

This update for busybox fixes the following issues:

• CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660).

• CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting (bsc#1069412).

• CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912).

• CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).

• CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).

• CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).

• CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).

• CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978).

• CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).

• CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869).

• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).

• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).

• CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).

• CVE-2011-5325: Fixed tar directory traversal (bsc#951562).

• CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263).

• Update to 1.35.0

  • awk: fix printf %%, fix read beyond end of buffer
  • chrt: silence analyzer warning
  • libarchive: remove duplicate forward declaration
  • mount: 'mount -o rw ....' should not fall back to RO mount
  • ps: fix -o pid=PID,args interpreting entire 'PID,args' as header
  • tar: prevent malicious archives with long name sizes causing OOM
  • udhcpc6: fix udhcp_find_option to actually find DHCP6 options
  • xxd: fix -p -r
  • support for new optoins added to basename, cpio, date, find, mktemp, wget and others

• Enable fdisk (jsc#CAR-16)

• Update to 1.34.1:

  • build system: use SOURCE_DATE_EPOCH for timestamp if available
  • many bug fixes and new features
  • touch: make FEATURE_TOUCH_NODEREF unconditional

• update to 1.33.1:

  • httpd: fix sendfile
  • ash: fix HISTFILE corruptio
  • ash: fix unset variable pattern expansion
  • traceroute: fix option parsing
  • gunzip: fix for archive corruption

• Update to version 1.33.0

  • many bug fixes and new features

• Update to version 1.32.1

  • fixes a case where in ash, 'wait' never finishes.

• prepare usrmerge (bsc#1029961)

• Enable testsuite and package it for later rerun (for QA, jsc#CAR-15)

• Update to version 1.31.1:

  • Bug fix release. 1.30.1 has fixes for dc, ash (PS1 expansion fix), hush, dpkg-deb, telnet and wget.

• Changes from version 1.31.0:

  • many bugfixes and new features.

• Add busybox-no-stime.patch: stime() has been deprecated in glibc 2.31 and replaced with clock_settime().

• update to 1.25.1:

  • fixes for hush, gunzip, ip route, ntpd

• includes changes from 1.25.0:

  • many added and expanded implementations of command options

• includes changes from 1.24.2:

  • fixes for build system (static build with glibc fixed), truncate, gunzip and unzip.

• Update to version 1.24.1

  • for a full list of changes see http://www.busybox.net/news.html

• Refresh busybox.install.patch

• Update to 1.23.2

  • for a full list of changes see http://www.busybox.net/news.html

• Cleaned up spec file with spec-cleaner

• Refreshed patches

• update to 1.22.1: Many updates and fixes for most included tools, see see http://www.busybox.net/news.html

It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated system were tricked into processing a specially crafted gzip archive, a remote attacker could use this issue to cause BusyBox to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-28831)

It was discovered that BusyBox incorrectly handled certain malformed LZMA archives. If a user or automated system were tricked into processing a specially crafted LZMA archive, a remote attacker could use this issue to cause BusyBox to crash, resulting in a denial of service, or possibly leak sensitive information. (CVE-2021-42374)

Vera Mens, Uri Katz, Tal Keren, Sharon Brizinov, and Shachar Menashe discovered that BusyBox incorrectly handled certain awk patterns. If a user or automated system were tricked into processing a specially crafted awk pattern, a remote attacker could use this issue to cause BusyBox to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386)

USN-5179-1 fixed vulnerabilities in BusyBox. This update provides the corresponding updates for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated system were tricked into processing a specially crafted gzip archive, a remote attacker could use this issue to cause BusyBox to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-28831)

It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated system were tricked into processing a specially crafted gzip archive, a remote attacker could use this issue to cause BusyBox to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2021-28831)

It was discovered that BusyBox did not properly validate user input when performing certain arithmetic operations. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause BusyBox to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2022-48174)