Debian Patches

Status for busybox/1:1.38.0-3

Patch Description Author Forwarded Bugs Origin Last update
shell-ash-export-HOME.patch busybox sh sets but does not export PATH
This patch exports $PATH variable from busybox ash by default,
even if no "export PATH" statement has been processed. No
other shell (dash, bash, ...) does this:

$ env - /bin/bash -c /usr/bin/env
PWD=/tmp
SHLVL=1
_=/usr/bin/env

But after #329406, busybox ash started exporting this variable
by default. This change hasn't been sent upstream.

However, this turned out to be problematic, after many upstream
changes, busybox started segfaulting in interesting and difficult
to debug environments - like, when running as pid=1 in initramfs.
This is recorded in #679377.

The problem was that PATH was the only variable marked to be
exported by default, and this is done by this very patch. Other
exported variables were always malloc'ed, but this one was not.
But when ash executes applets marked as NOEXEC, it does not
really execute anything, it forks and runs the applet's main()
function, clearing and setting up the environment as it'd do
for any other command. There, it is assumed that all exported
variables were malloc'ed, and the function (tryexec() in ash.c)
writes to the place in exported variable where the equal sign
is. So, if ash inherited no PATH variable and the default is
used, the code will try to write \0 into a constant location,
and we'll get a segfault.

The whole patch is probably not needed (because other shells
don't export PATH by default), but at this stage (during wheezy
freeze) we can't just drop it, since it may lead to some random
breakage in some other random place (and that'll be another
very difficult to debug issue). So instead of dropping the
patch, we modify the PATH variable to be stored in non-const
location, ie, to be writable. It is safe, since the only
place which actually modifies this variable (after the first
half of this patch) is the awk main function, during setup,
it restores the overridden byte after touching it, and it
is a "terminal" applet, ie, it exits after doing its work.

For wheezy+1, we should drop this patch completely. For
now, we will live with this simple and ugly forkaround.

/mjt		 Joey Hess <joeyh@debian.org> no debian 2006-05-07
version.patch build-sys: allow override of BB_BT (build tag) from command line Bastian Blank <waldi@debian.org> no 2008-03-28
init-console.patch skip non-existing devices in inittab
This patch causes init silently skip running processes from inittab if
the terminal name is specified but the corresponding device file does not
exist.		 Bastian Blank <waldi@debian.org> no debian
stop-checking-ancient-kernel-version.patch stop checking ancient kernel version for NFS mount
The nfs mount code checks for ancient kernel 2.2.18 (!) to determine
which mount protocol to use (v3 or v4). Stop doing this, and always
use v4.

This is the only place in debian busybox which uses get_linux_version_code()
function which can't deal with less-than-3-component kernel version numbers
(#684611). (Other places are in modutils/ to determine whenever to use
pre-2.4 module loading way, which is disabled in debian build).

This is a band-aid patch, to minimize changes, more complete cleanup
is needed for all this code upstream.		 Michael Tokarev <mjt@tls.msk.ru> no debian
platform-linux.diff buildsys: resurrect PLATFORM_LINUX and depend on it for linux-specific applets

This effectively reverts the following two commits:

commit e3b1a1fd28558f7a1b3c0ec33313bedb675be8a1
Author: Denys Vlasenko <vda.linux@googlemail.com>
Date: Sat Feb 26 22:24:08 2011 +0100

Replace "depends on PLATFORM_LINUX" with "select PLATFORM_LINUX"

and

commit 5c69ad0ecdc18cf51b312c7c82848f4438fe1c8d
Author: Ron Yorston <rmy@pobox.com>
Date: Tue Aug 4 08:24:19 2020 +0100

build system: drop PLATFORM_LINUX

but does, hopefully, the right thing.

Original complain was that the allnoconfig turns off PLATFORM_LINUX
on which all linux-specific applets depends. Instead of setting this
config option right for linux and non-linux (initially it was just a
regular kconfig symbol, not set depending on the platform), it were
turned into something which made little sense (in the first commit),
and later dropped completely.

So introduce a dynamic kconfig symbol PLATFORM_LINUX with the value
actually depending on the target platform, so that it is not affected
by all{yes|no|whatever}config. This way, it is possible to depend on
it for linux-specific applets without breaking *config anymore.

It is done by creating a small kconfig fragment, .platform.in, to
define just PLATFORM_LINUX symbol. It is created in Makefile if
${CPP} has __linux__ #defined. And include it in the top-level Config.in.

Regenerate default config files with the new symbol.

And mark all the applets which were marked as "select PLATFORM_LINUX"
before the "build system: drop PLATFORM_LINUX" commit, as
"depends on PLATFORM_LINUX".

Also mark 2 other applets, tc and dhcprelay, as linux-only too.

This way, it is finally possible to build busybox on other platforms
without really huge efforts to maintain list of "incompatible" applets
externally, and does not put any pressure on the main development, -
the only thing needed is to keep the existing "depends on PLATFORM_LINUX"
lines.		 Michael Tokarev <mjt@tls.msk.ru> no 2024-09-30
fix-non-linux-build.patch Fix non-Linux builds
Some features are Linux-only.

diff --git a/networking/traceroute.c b/networking/traceroute.c
index 4bbe1ab8e..2ba990fd0 100644		 Samuel Thibault <samuel.thibault@ens-lyon.org> no 2022-10-16
syslogd-option_mask32.patch syslogd problem
diff --git a/sysklogd/syslogd.c b/sysklogd/syslogd.c
index 83b5c0cf6..97578813b 100644		 Jeff Pohlmeyer <yetanothergeek@gmail.com> invalid 2023-09-21
syslogd-make-it-optionally-systemd-socket-activated.patch syslogd: make it optionally systemd-socket-activated
In order for busybox-syslogd to work with systemd, it needs to be
This patch implements very basic of sd_listen_fds(3) for syslogd context.
We only check for single LISTEN_FD and require it to be AF_LINUX socket.

diff --git a/sysklogd/syslogd.c b/sysklogd/syslogd.c
index 6ddfd771a..b7d0fbe6b 100644		 Michael Tokarev <mjt@tls.msk.ru> no 2023-11-16
busybox-1.36.1-no-cbq.patch diff -up busybox-1.36.1/networking/tc.c.no-cbq busybox-1.36.1/networking/tc.c invalid fedora 2024-07-16
awk.c-fix-CVE-2023-42366-bug-15874.patch awk.c: fix CVE-2023-42366 (bug #15874)
Make sure we don't read past the end of the string in next_token()
when backslash is the last character in an (invalid) regexp.
a fix and issue reported in bugzilla

https://bugs.busybox.net/show_bug.cgi?id=15874		 Valery Ushakov <uwe@stderr.spb.ru> no 2024-01-24
wget-disallow-control-chars-in-URLs-CVE-2025-60876.patch wget: don't allow control characters or spaces in the URL
Fixes CVE-2025-60876 malicious URL can be used to inject
HTTP headers in the request.		 Radoslav Kolev <radoslav.kolev@suse.com> invalid debian 2025-11-21
archival-libarchive-sanitize-filenames-on-output-CVE-2025-46394-2.patch missing part of CVE-2025-46394 fix
diff --git a/archival/libarchive/header_verbose_list.c b/archival/libarchive/header_verbose_list.c
index a575a08a0..e4ee939c0 100644		 Michael Tokarev <mjt@tls.msk.ru> invalid debian 2026-02-01
netstat-sanitize-argv0-for-p-CVE-2024-58251.patch netstat: CVE-2024-58251 - sanitize argv0 for -p Valery Ushakov <valery.ushakov@bell-sw.com> no debian 2025-08-21
cpio-tests-echo.diff testsuite/cpio.tests: replace echo with $ECHO
Not every implementation of echo understands -e, this
is why $ECHO is used elsewhere. Replace echo -e with
$ECHO -e.


diff --git a/testsuite/cpio.tests b/testsuite/cpio.tests		 Michael Tokarev <mjt@tls.msk.ru> invalid 2026-06-11
ls-tests-printf.diff ls.tests: replace printf with $ECHO -ne
testsuite/ls.tests uses printf to produce a filename, but uses
\xNN escape sequence. Dash (debian default) has printf buult-in,
but it does not understand \xNN, - it produces literal \xNN
instead of a single-byte corresponding to the value NN.
So the test fails.

Replace printf with $ECHO -ne - this one is used elsewhere
for similar purpose.


diff --git a/testsuite/ls.tests b/testsuite/ls.tests		 Michael Tokarev <mjt@tls.msk.ru> invalid 2026-06-11
coreutils-cut.c-typo-fix-delimeter.patch coreutils/cut.c: typo fix (delimeter) Michael Tokarev <mjt@tls.msk.ru> invalid 2026-07-11
ash-omit-variables-with-invalid-names-in-showvars.patch ash: omit variables with invalid names in showvars()
showvars() in shell/ash.c produces incomplete output when
environment variable has invalid characters in name (on
the left of the equal sign):

$ env test/test=test busybox ash -c set | grep ^test
test
$ _

Instead of printing incomplete variable names with no values,
just omit printing these variables entirely. This is how `set`
builtin behaves in bash implementation, too.

Note that previous change in this place, which was supposed to
make `export -p` eval'able, actually did not succeed, because
such bare names without an equal sign are not actually eval'able
this way, they're interpreted by `eval` as a command name to
execute, instead of to add this name to environment.

(This function is used for `export -p` and `set`).		 Michael Tokarev <mjt@tls.msk.ru> invalid 2026-07-12
ash-fix-out-of-bounds-read-in-ifsbreakup-CVE-2026-38754.patch ash: fix out-of-bounds read in ifsbreakup()
ifsfree() does not only release allocated ifsregion nodes; it also clears
the global IFS region state used by ifsbreakup(). If argstr() raises an
error while expanding an argument, ash longjmps out of expandarg() before
that cleanup runs, leaving stale IFS split offsets behind.

A later expansion can reuse the stack for a shorter string. ifsbreakup()
then sees the stale IFS state, trusts the old offsets, and can walk past
the current stack block before dereferencing p.

Follow dash's root-cause fix: when an expansion-related handler catches
EXERROR and continues, restore the handler and call ifsfree(). Apply
the cleanup to redirectsafe(), expandstr(), and evaltree().

Upstream commit:

Date: Mon Dec 5 23:02:01 2022 +0800
expand: Add ifsfree to expand to fix a logic error that causes a buffer over-read

On Mon, Jun 20, 2022 at 02:27:10PM -0400, Alex Gorinson wrote:
> Due to a logic error in the ifsbreakup function in expand.c if a
> heredoc and normal command is run one after the other by means of a
> semi-colon, when the second command drops into ifsbreakup the command
> will be evaluated with the ifslastp/ifsfirst struct that was set when
> the here doc was evaluated. This results in a buffer over-read that
> can leak the program's heap, stack, and arena addresses which can be
> used to beat ASLR.
>
> Steps to Reproduce:
> First bug:
> cmd args: ~/exampleDir/example> dash
> $ M='AAAAAAAAAAAAAAAAA' <note: 17 A's>
> $ q00(){
> $ <<000;echo
> $ ${D?$M$M$M$M$M$M} <note: 6 $M's>
> $ 000
> $ }
> $ q00 <note: After the q00 is typed in, the leak
> should be echo'd out; this works with ash, busybox ash, and dash and
> with all option args.>
>
> Patch:
> Adding the following to expand.c will fix both bugs in one go.
> (Thank you to Harald van Dijk and Michael Greenberg for doing the
> heavy lifting for this patch!)
> ==========================
> --- a/src/expand.c
> +++ b/src/expand.c
> @@ -859,6 +859,7 @@
> if (discard)
> return -1;
>
> +ifsfree();
> sh_error("Bad substitution");
> }
>
> @@ -1739,6 +1740,7 @@
> } else
> msg = umsg;
> }
> +ifsfree();
> sh_error("%.*s: %s%s", end - var - 1, var, msg, tail);
> }
> ==========================

Thanks for the report!

I think it's better to add the ifsfree() call to the exception
handling path as other sh_error calls may trigger this too.

function old new delta
restore_handler_expandarg - 33 +33
evaltree 725 711 -14
static.redirectsafe 141 124 -17
expandstr 262 242 -20		 Sanghyun Park <sanghyun.park.cnu@gmail.com> not-needed debian upstream, commit a448b6d5b21e5b21249391389b6f0551d9bea136 2026-06-18
ash-fix-stack-overflow-in-evalfun-CVE-2026-38755.patch ash: fix stack overflow in evalfun()
Recursive shell functions can repeatedly enter evalfun() until the
process stack is exhausted. Track active shell function calls and raise a
normal shell error when the recursion limit is reached.

The counter is decremented through the existing funcdone cleanup path so
errors raised from inside the function body unwind it correctly.		 Sanghyun Park via busybox <busybox@busybox.net> invalid debian upstream, https://lists.busybox.net/pipermail/busybox/2026-June/092354.html 2026-06-16
awk-fix-stack-overflow-in-evaluate-CVE-2026-38752.patch awk: fix stack overflow in evaluate()
Recursive awk functions can keep re-entering evaluate() until the
process stack is exhausted. Track active function-call depth and report a
normal awk error once the limit is reached instead of overflowing the
stack.		 Sanghyun Park via busybox <busybox@busybox.net> invalid debian upstream, https://lists.busybox.net/pipermail/busybox/2026-June/092351.html 2026-06-16
awk-fix-use-after-free-in-awk_sub-CVE-2026-38753.patch awk: fix use-after-free in awk_sub()
awk_sub() receives the replacement text as a pointer into awk variable
storage. Evaluating the regular expression argument can change that
storage through as_regex(), leaving the replacement pointer dangling
before strlen() and the replacement loop use it.

Copy the replacement string before calling as_regex() so substitution
uses stable storage for the duration of the operation.		 Sanghyun Park via busybox <busybox@busybox.net> invalid debian upstream, https://lists.busybox.net/pipermail/busybox/2026-June/092352.html 2026-06-16

All known versions for source package 'busybox'

Links