Re: security alerts in busybox

On 24 Apr 2026 at 16:40, Roberto A. Foglietta via busy wrote:

Date sent:      	Fri, 24 Apr 2026 16:40:47 +0200
Subject:        	security alerts in busybox
To:             	Busybox <[email protected]>
From:           	"Roberto A. Foglietta via busybox" 
<[email protected]>
Send reply to:  	"Roberto A. Foglietta" 
<[email protected]>

> Hi,
> 
> Using a static code analyser, I found:

Could you provide details on exactly what code was being 
analysed? 
Many sites are only seeing the 1.37.0 code as being released even 
thou it shows as unstable, and last stable release was 1.36.1.

Just had some emails with debian community group, and he flat out 
said, they don't do anything with 1.38, and Fedora repo has 
1.37.0-3 listed. Seems the -3 means they installed some patches?

The last update on 4/13 was a major change to libbb, telnet.c and 
telnetd.c linked to a CVE issue. 

So is that anaysis on the 1 1/2 year old 1.37.0 code, the 1.36.1 last 
stable code, or the lastest change in the 1.38 git snapshot of 4/13. 
Later snapshots but code is the same.

2669360 Mar 25 10:20 busybox-20260325.tar.bz2
2669851 Apr 13 10:20 busybox-20260413.tar.bz2




> 
> Open potentially alerts by severity/class in branch `main`:
> 
> - **security**: 103 critical, 96 high, 4 medium, **203 total**
> 
> Alerts above are related to C-language code, none otherwise.
> 
> Are these false positives? Well, it is more about corner cases like
> using the applet in a strong parallel mode like xargs -p8 does. If
> used for maintenance on a large enough infrastructure, the corner case
> has a chance to be met, for example.
> 
> https://github.com/robang74/busybox/commits/security/
> 
> commit f69e57f62798ae2bca9f5071adb45bfb002002b1 (HEAD -> security,
> origin/security)
> Author: Roberto A. Foglietta <[email protected]>
> Date:   Fri Apr 24 15:33:58 2026 +0200
> 
>     util-linux/ipcs.c: use of potentially dangerous function (fix)
> 
>     Alerts: #96-93,91,88-83,81-77
> 
>     +:git-shell:security:busybox> size busybox
>        text    data     bss     dec     hex filename
>     1155501   18124    2056 1175681  11f081 busybox
>     1155670   18132    2056 1175858  11f132 busybox
>                                +177
> 
> These are trivial alerts, therefore I faced it first to provide an
> example. And the second main question is straightforward: does this
> fix worth 177 bytes? In relative terms it is 150 ppm compared with the
> full size footprint. In terms of certifications is a solid step
> towards peace of mind.
> 
> Best regards, R-
> _______________________________________________
> busybox mailing list
> [email protected]
> https://lists.busybox.net/mailman/listinfo/busybox


+------------------------------------------------------------+
 Michael D. Setzer II - Computer Science Instructor (Retired)     
 mailto:[email protected]                            
 mailto:[email protected]
 mailto:[email protected]
 Guam - Where America's Day Begins                        
 G4L Disk Imaging Project maintainer 
 http://sourceforge.net/projects/g4l/
+------------------------------------------------------------+