Re: security alerts in busybox

On 24 Apr 2026 at 16:40, Roberto A. Foglietta via busy wrote:

Date sent:      	Fri, 24 Apr 2026 16:40:47 +0200
Subject:        	security alerts in busybox
To:             	Busybox <[email protected]>
From:           	"Roberto A. Foglietta via busybox" 
<[email protected]>
Send reply to:  	"Roberto A. Foglietta" 
<[email protected]>

> Hi,
> 
> Using a static code analyser, I found:
> 
> Open potentially alerts by severity/class in branch `main`:
> 
> - **security**: 103 critical, 96 high, 4 medium, **203 total**
> 
> Alerts above are related to C-language code, none otherwise.
> 
> Are these false positives? Well, it is more about corner cases like
> using the applet in a strong parallel mode like xargs -p8 does. If
> used for maintenance on a large enough infrastructure, the corner case
> has a chance to be met, for example.
> 
> https://github.com/robang74/busybox/commits/security/
> 
> commit f69e57f62798ae2bca9f5071adb45bfb002002b1 (HEAD -> security,
> origin/security)
> Author: Roberto A. Foglietta <[email protected]>
> Date:   Fri Apr 24 15:33:58 2026 +0200
> 
>     util-linux/ipcs.c: use of potentially dangerous function (fix)
> 

I must really be missing something I compared the ipcs.c file from 
latest busybox snapshot 4/12, busybox 1.37.0 bz2, and the 
robang74 git clone.

Files are all exactly the same. 
Also, looked from dangerous function (fix) but there is none that I 
see?

I've only used git clone and git pull so perhaps missing something.

doing diffs between 1.37.0 and 1.38 git large number, between 3-25 
and 4-13 small.

  24200 diff1-1.37-1.38
    157 diff1-3-25-4-13
  39081 diff2-1.37-1.38
    282 diff2-3-25-4-13
    331 diffstat-1.37-1.38
      8 diffstat-3-25-4-13

 cat diffstat-3-25-4-13 
 include/libbb.h                            |    4 +--
 libbb/ioloop.c                             |   30 +++++++++++-----------
 networking/telnet.c                        |   16 ++++++------
 networking/telnetd.c                       |   38 
++++++++++++++---------------
 shell/hush_test/hush-misc/tickquote1.right |    1 
 shell/hush_test/hush-misc/tickquote1.tests |    2 -
 testsuite/cmp/cmp-detects-difference       |    9 ------
 7 files changed, 44 insertions(+), 56 deletions(-)





>     Alerts: #96-93,91,88-83,81-77
> 
>     +:git-shell:security:busybox> size busybox
>        text    data     bss     dec     hex filename
>     1155501   18124    2056 1175681  11f081 busybox
>     1155670   18132    2056 1175858  11f132 busybox
>                                +177
> 
> These are trivial alerts, therefore I faced it first to provide an
> example. And the second main question is straightforward: does this
> fix worth 177 bytes? In relative terms it is 150 ppm compared with the
> full size footprint. In terms of certifications is a solid step
> towards peace of mind.
> 
> Best regards, R-
> _______________________________________________
> busybox mailing list
> [email protected]
> https://lists.busybox.net/mailman/listinfo/busybox


+------------------------------------------------------------+
 Michael D. Setzer II - Computer Science Instructor (Retired)     
 mailto:[email protected]                            
 mailto:[email protected]
 mailto:[email protected]
 Guam - Where America's Day Begins                        
 G4L Disk Imaging Project maintainer 
 http://sourceforge.net/projects/g4l/
+------------------------------------------------------------+