Re: Arbitrary file truncation in busybox patch binary

On Tue, 14 Apr 2026 at 00:01, Arthur Chan via busybox
<[email protected]> wrote:
>
> Hi,
>
> I am writing to report an arbitrary file truncation in busybox project and specifically in the patch binary when processing a malicious patch file could truncate or create arbitrary file in the file system with the user privilege.
>
> It is triggerable through the `busybox patch` when the system manager or cornjob applys regular patches which include a malicious patch file. It will result in arbitrary file truncation or creation through direct path traversal that may affect important system file with the user privilege.
>
> I have attached a markdown arbitrary_file_truncation.md that holds detail descriptions and reproduction steps of the vulnerability.
>
> This issue was found by Anthropic from using agents to study security of open source projects, and I am from Ada Logics helping validate the found issues and report to maintainers. The data in this email has been reviewed manually.
>
> Please let me know if you have any questions!
>
> Kind regards,
> Arthur Chan
>
>
>
> ADA Logics Ltd is registered in England. No: 11624074.
> Registered office: 266 Banbury Road, Post Box 292,
> OX2 7DL, Oxford, Oxfordshire , United Kingdom

oh-oh, anthropic...

this is the patch developed by Claude Sonnet 4.6

https://claude.ai/share/3846ba11-0b6e-4f0c-9cb6-34beaa11c49c

this is the patch developed by Gemini

https://gemini.google.com/share/602d38b9f121

both based on free-of-charge chatbot services

Gemini won, IMHO at first sight, by using "strstr" even though it
failed to create/adopt a sort of sanitise_path_check() function.
Because there is a good chance that the same issue affects other
applets (like tar, for example, possibly).

WARNING:

I did not review or check the patches available on those links above,
that material is provided just for AI developing skills comparison not
for AS-IS real-world use.

Best regards,
-- 
Roberto A. Foglietta
+49.176.274.75.661
+39.349.33.30.697