Heap Out-of-Bounds Write in BusyBox passwd/group

Executive Summary

CVE-2026-88839 is a vulnerability in BusyBox's passwd and group file parser. The tokenize() function trims trailing whitespace but incorrectly keeps a stale pointer. This causes an excessively large tokenize_end value, leading to under-allocation in parse_common(). When convert_to_struct() writes gr_mem[] pointers, it exceeds allocated heap memory, causing an out-of-bounds write.

Useful 0 Not Useful 0

Detection Guidance

Check /etc/group and /etc/passwd for malformed entries with whitespace before commas. Use commands like 'cat /etc/group | grep -E ",\s+"' to identify suspicious entries. Monitor for crashes in BusyBox applets calling getgrnam().

Inspect heap corruption signs such as application crashes or memory errors when parsing group files. Enable core dumps for analysis if crashes occur.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause crashes or undefined behavior due to heap memory corruption. If exploited, it may lead to denial-of-service conditions or unauthorized code execution. However, on systems like Fedora 44 with SELinux, root access is required to modify /etc/group, limiting practical impact since root already has full control.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict write access to /etc/group and /etc/passwd to root only. Use chmod 600 for these files. Enable SELinux or similar mandatory access controls to prevent unauthorized modifications.

Monitor /etc/group and /etc/passwd for unauthorized changes. Apply patches or updates from BusyBox upstream if available. Avoid granting unnecessary root privileges.

Useful 0 Not Useful 0