DescriptionAn issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs918846

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
busybox (PTS)jessie1:1.22.0-9+deb8u1vulnerable
jessie (security)1:1.22.0-9+deb8u4vulnerable
bullseye, sid, buster1:1.30.1-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[stretch] - busybox <no-dsa> (Minor issue)
[jessie] - busybox <no-dsa> (Minor issue)
When fixing this issue make sure to not open CVE-2019-5747 by only
applying the partial fix. The followup commit
is needed to fix the issue completely.

Search for package or bug name: Reporting problems