For details on CVE-2015-1817, see: http://www.openwall.com/lists/musl/2015/03/30/1
With musl-linked Busybox installed setuid and ping enabled, exploiting this issue is trivial. While CVE-2015-1817 is certainly musl's fault, there are two changes to Busybox I'd like to propose that would have prevented it from being exploitable: 1. Having setuid utilities like ping obtain the resource they need (in the case of ping, SOCK_RAW) without processing user input at all, then fully dropping root (setuid(getuid())) before doing anything. This has been standard practice for setuid programs since the 90s and it feels bad that busybox is not doing it. 2. Reconsider the rejection of the patch to add SOCK_DGRAM support for ping, which allows it to run without root. Do either or both of these sound acceptable? Rich _______________________________________________ busybox mailing list busybox@busybox.net http://lists.busybox.net/mailman/listinfo/busybox
