DescriptionAn issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs918846

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
busybox (PTS)stretch1:1.22.0-19vulnerable
stretch (security)1:1.22.0-19+deb9u2vulnerable
bookworm, sid1:1.30.1-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[stretch] - busybox <no-dsa> (Minor issue)
[jessie] - busybox <no-dsa> (Minor issue)
When fixing this issue make sure to not open CVE-2019-5747 by only
applying the partial fix. The followup commit
is needed to fix the issue completely.

Search for package or bug name: Reporting problems