Infinite loop in busybox (Alpine package)

1) Infinite loop

EUVDB-ID: #VU16154

Risk: Low

CVSSv3.1: 5.4 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14629

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to cause DoS condition.

The vulnerability exists due to infinite query recursion caused by CNAME loops. A local attacker can add any dns record via ldap using the ldbadd tool, trigger infinite loop and cause the server to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

busybox (Alpine package): 1.31.1-r16 - 1.31.1-r21

busybox (Alpine package):

CPE2.3

• cpe:2.3:o:alpine:busybox_alpine_package:1.31.1-r17:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:busybox_alpine_package:1.31.1-r18:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:busybox_alpine_package:1.31.1-r19:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:busybox_alpine_package::*:*:*:*:alpine_linux:*:

External links

http://git.alpinelinux.org/aports/commit/?id=76077dfdd8d77220a469c5743b7b7fd3484300a1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.