diff mbox series

[wrynose,2/3] busybox: fix CVE-2026-38753

Message ID 20261016065314.3923094-2-dkelaiya@cisco.com
State New
Delegated to: Yoann Congal
Headers show
Series [wrynose,1/3] busybox: fix CVE-2026-38752 | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 6:53 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix shown in [1].
The advisory identifying the fix is referenced in [2].

[1] https://lists.busybox.net/pipermail/busybox/2026-June/092352.html
[2] https://nvd.nist.gov/vuln/detail/cve-2026-38753

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../busybox/busybox/CVE-2026-38753.patch      | 54 +++++++++++++++++++
 meta/recipes-core/busybox/busybox_1.37.0.bb   |  1 +
 2 files changed, 55 insertions(+)
 create mode 100644 meta/recipes-core/busybox/busybox/CVE-2026-38753.patch
diff mbox series

Patch

diff --git a/meta/recipes-core/busybox/busybox/CVE-2026-38753.patch b/meta/recipes-core/busybox/busybox/CVE-2026-38753.patch
new file mode 100644
index 00000000000..b7095b0d379
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/CVE-2026-38753.patch
@@ -0,0 +1,54 @@ 
+From 2ab1e56dbb740769b703822d839222c68813a97b Mon Sep 17 00:00:00 2001
+From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Date: Tue, 16 Jun 2026 12:18:43 +0900
+Subject: [PATCH] awk: fix use-after-free in awk_sub()
+
+awk_sub() receives the replacement text as a pointer into awk variable
+storage. Evaluating the regular expression argument can change that
+storage through as_regex(), leaving the replacement pointer dangling
+before strlen() and the replacement loop use it.
+
+Copy the replacement string before calling as_regex() so substitution
+uses stable storage for the duration of the operation.
+
+CVE: CVE-2026-38753
+Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2026-June/092352.html]
+
+Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ editors/awk.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/editors/awk.c b/editors/awk.c
+index 299e480..e0781ee 100644
+--- a/editors/awk.c
++++ b/editors/awk.c
+@@ -2561,6 +2561,7 @@ static char *awk_printf(node *n, size_t *len)
+ static int awk_sub(node *rn, const char *repl, int nm, var *src, var *dest /*,int subexp*/)
+ {
+ 	char *resbuf;
++	char *repl_copy;
+ 	const char *sp;
+ 	int match_no, residx, replen, resbufsize;
+ 	int regexec_flags;
+@@ -2578,7 +2579,9 @@ static int awk_sub(node *rn, const char *repl, int nm, var *src, var *dest /*,in
+ 	resbuf = NULL;
+ 	residx = 0;
+ 	match_no = 0;
++	repl_copy = xstrdup(repl);
+ 	regex = as_regex(rn, &sreg);
++	repl = repl_copy;
+ 	sp = getvar_s(src ? src : intvar[F0]);
+ #if defined(REG_STARTEND)
+ 	src_string = sp;
+@@ -2668,6 +2671,7 @@ static int awk_sub(node *rn, const char *repl, int nm, var *src, var *dest /*,in
+ 	setvar_p(dest ? dest : intvar[F0], resbuf);
+ 	if (regex == &sreg)
+ 		regfree(regex);
++	free(repl_copy);
+ 	return match_no;
+ }
+ 
+-- 
+2.35.6
diff --git a/meta/recipes-core/busybox/busybox_1.37.0.bb b/meta/recipes-core/busybox/busybox_1.37.0.bb
index d4352fd4cbe..8da8338a57b 100644
--- a/meta/recipes-core/busybox/busybox_1.37.0.bb
+++ b/meta/recipes-core/busybox/busybox_1.37.0.bb
@@ -67,6 +67,7 @@  SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://CVE-2026-29004-01.patch \
            file://CVE-2026-29004-02.patch \
            file://CVE-2026-38752.patch \
+           file://CVE-2026-38753.patch \
            file://CVE-2026-38754.patch \
            "
 SRC_URI:append:libc-musl = " file://musl.cfg"