netstat is also vulnerable to busybox's CVE-2024-58251

[ricardobranco777]

https://lists.busybox.net/pipermail/busybox/2025-November/091804.html

(ln -sf /usr/bin/nc /tmp/nc$(printf '\033[1mfoo\033[0m'); /tmp/nc* -l 31337 &); netstat -alp

http://web.archive.org/web/20241009201026/https://bugs.busybox.net/show_bug.cgi?id=15922

The following code displays a X as the title of an ANSI terminal. Without the final '\007' the terminal can be locked up.

I think the project in general would benefit from an audit of every line using /proc//cmdline, /proc//comm, /proc//environ and even the symlinks /proc//exe & cwd.

$ cat > a.c << EOF
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <err.h>

int main(int argc, char *argv[]) {
	struct sockaddr_in sin;
	int s;

	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		err(1, "socket()");

	memset(&sin, 0, sizeof(sin));
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = INADDR_ANY;

	if (bind(s, (struct sockaddr*)&sin, sizeof(sin)) < 0)
		err(1, "bind()");

	strcpy(argv[0], "/\033]0;X\007");

	while (1)
		sleep(3600);
}
EOF

$ unset PROMPT_COMMAND

$ cc a.c

$ ./a.out &

$ netstat -aup

[stanislav-brabec]

Hopefully, this problem is already addressed in the procps-ng/library/readproc.c, so we can just use this code here, in busybox and in iproute2. I just tested an easy approach with a completely unmodified readproc.c code. Adding this code just before the final snprintf() works:

int rightward = 512;
escape_str (ecmdlbuf, cmdlp, 512, &rightward);

But such solution needs an extra copy, so I'll try to use escape_str() instead of safe_strncpy().

There is a minor license problem: readproc.c is LGPL, net tools is GPL. So escape_str() has to be in an extra file with a different license. I'll consult it with the legal team, as this will not constitute a separate library. But I guess that static linking of a function will be OK as well.

SUSE bug tracker reference: https://bugzilla.suse.com/show_bug.cgi?id=1254323

[ecki]

I think we can just filter with a simple loop, no need for an extra library, question is if we need to do it in more places.

[stanislav-brabec]

We don't need an extra library. But we should put the code into an extra file for licensing reason.

There is a proposed patch for iproute2 based on the same code, using the same way to fix it. If is nor approved yet, but s it has a CVE-2024-58251 assigned now, it will probably be fixed sometimes in a near future.