Skip to content

Commit 87345f5

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch busybox for CVE-2026-38755, CVE-2026-38754 [HIGH] (#18056)
1 parent 616bc87 commit 87345f5

3 files changed

Lines changed: 177 additions & 1 deletion

File tree

‎SPECS/busybox/CVE-2026-38754.patch‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
From fc3c48fa3599e152caccc3c7e9e2f349750cdede Mon Sep 17 00:00:00 2001
2+
From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
3+
Date: Mon, 20 Jul 2026 06:28:02 +0000
4+
Subject: [PATCH] CVE-2026-38754 ifsbreakup() skips over CTLESC before testing
5+
the following byte against
6+
7+
IFS. If CTLESC is the last byte in the recorded region, the scan
8+
advances to the region end and can dereference one byte past it.
9+
10+
The recorded region can also be stale after error unwinding, so cap each
11+
scan to the current stack block before walking it and make the final
12+
empty-string check respect the same bound.
13+
14+
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
15+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
16+
Upstream-reference: https://lists.busybox.net/pipermail/busybox/2026-June/092353.html
17+
---
18+
shell/ash.c | 30 +++++++++++++++++++++++++-----
19+
1 file changed, 25 insertions(+), 5 deletions(-)
20+
21+
diff --git a/shell/ash.c b/shell/ash.c
22+
index 9344e4d..7bdd5f0 100644
23+
--- a/shell/ash.c
24+
+++ b/shell/ash.c
25+
@@ -6136,13 +6136,16 @@ ifsbreakup(char *string, struct arglist *arglist)
26+
struct ifsregion *ifsp;
27+
struct strlist *sp;
28+
char *start;
29+
+ char *end;
30+
char *p;
31+
char *q;
32+
+ char *stack_end;
33+
const char *ifs, *realifs;
34+
int ifsspc;
35+
int nulonly;
36+
37+
start = string;
38+
+ stack_end = (char *)stackblock() + stackblocksize();
39+
if (ifslastp != NULL) {
40+
ifsspc = 0;
41+
nulonly = 0;
42+
@@ -6152,14 +6155,26 @@ ifsbreakup(char *string, struct arglist *arglist)
43+
int afternul;
44+
45+
p = string + ifsp->begoff;
46+
+ end = string + ifsp->endoff;
47+
+ if (end > stack_end)
48+
+ end = stack_end;
49+
+ if (p >= end) {
50+
+ ifsp = ifsp->next;
51+
+ continue;
52+
+ }
53+
afternul = nulonly;
54+
nulonly = ifsp->nulonly;
55+
ifs = nulonly ? nullstr : realifs;
56+
ifsspc = 0;
57+
- while (p < string + ifsp->endoff) {
58+
+ while (p < end) {
59+
q = p;
60+
- if ((unsigned char)*p == CTLESC)
61+
+ if ((unsigned char)*p == CTLESC) {
62+
p++;
63+
+ if (p >= end) {
64+
+ p = q;
65+
+ break;
66+
+ }
67+
+ }
68+
if (!strchr(ifs, *p)) {
69+
p++;
70+
continue;
71+
@@ -6180,12 +6195,17 @@ ifsbreakup(char *string, struct arglist *arglist)
72+
p++;
73+
if (!nulonly) {
74+
for (;;) {
75+
- if (p >= string + ifsp->endoff) {
76+
+ if (p >= end) {
77+
break;
78+
}
79+
q = p;
80+
- if ((unsigned char)*p == CTLESC)
81+
+ if ((unsigned char)*p == CTLESC) {
82+
p++;
83+
+ if (p >= end) {
84+
+ p = q;
85+
+ break;
86+
+ }
87+
+ }
88+
if (strchr(ifs, *p) == NULL) {
89+
p = q;
90+
break;
91+
@@ -6210,7 +6230,7 @@ ifsbreakup(char *string, struct arglist *arglist)
92+
goto add;
93+
}
94+
95+
- if (!*start)
96+
+ if (start >= stack_end || !*start)
97+
return;
98+
99+
add:
100+
--
101+
2.45.4
102+

‎SPECS/busybox/CVE-2026-38755.patch‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
From 46496da2ec13ac56b7aa687832f0a3bb355361ab Mon Sep 17 00:00:00 2001
2+
From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
3+
Date: Mon, 20 Jul 2026 06:28:50 +0000
4+
Subject: [PATCH] CVE-2026-38755
5+
6+
Recursive shell functions can repeatedly enter evalfun() until the
7+
process stack is exhausted. Track active shell function calls and raise a
8+
normal shell error when the recursion limit is reached.
9+
10+
The counter is decremented through the existing funcdone cleanup path so
11+
errors raised from inside the function body unwind it correctly.
12+
13+
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
14+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
15+
Upstream-reference: https://lists.busybox.net/pipermail/busybox/2026-June/092354.html
16+
---
17+
shell/ash.c | 8 ++++++++
18+
1 file changed, 8 insertions(+)
19+
20+
diff --git a/shell/ash.c b/shell/ash.c
21+
index 7bdd5f0..974fb57 100644
22+
--- a/shell/ash.c
23+
+++ b/shell/ash.c
24+
@@ -402,6 +402,7 @@ struct globals_misc {
25+
int shlvl;
26+
#define rootshell (!shlvl)
27+
int errlinno;
28+
+ unsigned func_depth;
29+
30+
char *minusc; /* argument to -c option */
31+
32+
@@ -489,6 +490,7 @@ extern struct globals_misc *BB_GLOBAL_CONST ash_ptr_to_globals_misc;
33+
#define rootpid (G_misc.rootpid )
34+
#define shlvl (G_misc.shlvl )
35+
#define errlinno (G_misc.errlinno )
36+
+#define func_depth (G_misc.func_depth )
37+
#define minusc (G_misc.minusc )
38+
#define curdir (G_misc.curdir )
39+
#define physdir (G_misc.physdir )
40+
@@ -9930,6 +9932,10 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
41+
int savefuncline;
42+
char *savefuncname;
43+
char *savetrap = NULL;
44+
+ enum { MAX_ASH_FUNC_DEPTH = 1000 };
45+
+
46+
+ if (func_depth >= MAX_ASH_FUNC_DEPTH)
47+
+ ash_msg_and_raise_error("function recursion limit exceeded");
48+
49+
if (!Eflag) {
50+
savetrap = trap[NTRAP_ERR];
51+
@@ -9948,6 +9954,7 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
52+
exception_handler = &jmploc;
53+
shellparam.malloced = 0;
54+
func->count++;
55+
+ func_depth++;
56+
funcname = func->n.ndefun.text;
57+
funcline = func->n.ndefun.linno;
58+
INT_ON;
59+
@@ -9969,6 +9976,7 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
60+
}
61+
funcline = savefuncline;
62+
lineno = savelineno;
63+
+ func_depth--;
64+
freefunc(func);
65+
freeparam(&shellparam);
66+
shellparam = saveparam;
67+
--
68+
2.45.4
69+

‎SPECS/busybox/busybox.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Statically linked binary providing simplified versions of system commands
22
Name: busybox
33
Version: 1.36.1
4-
Release: 24%{?dist}
4+
Release: 25%{?dist}
55
License: GPLv2
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -19,6 +19,8 @@ Patch5: CVE-2023-42366.patch
1919
Patch6: CVE-2023-39810.patch
2020
Patch7: CVE-2022-48174.patch
2121
Patch8: CVE-2026-26157.patch
22+
Patch9: CVE-2026-38754.patch
23+
Patch10: CVE-2026-38755.patch
2224
BuildRequires: gcc
2325
BuildRequires: glibc-static >= 2.38-20%{?dist}
2426
BuildRequires: libselinux-devel >= 1.27.7-2
@@ -110,6 +112,9 @@ cd testsuite
110112
%{_mandir}/man1/busybox.petitboot.1.gz
111113

112114
%changelog
115+
* Mon Jul 20 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.36.1-25
116+
- Patch for CVE-2026-38755, CVE-2026-38754
117+
113118
* Thu May 07 2026 Aditya Singh <v-aditysing@microsoft.com> - 1.36.1-24
114119
- Bump to rebuild with updated glibc
115120

0 commit comments

Comments
 (0)