https://lists.busybox.net/pipermail/busybox/2025-August/091665.html

I am happy to observe a 30-day embargo to coordinate with downstream distributions. Please let me know if you need more or less time.

🤦‍♀️

[SECURITY] busybox tar: TOCTOU symlink race overwrites arbitrary root file with --overwrite

working on busybox updates, obviously... no CVE number yet

fixed versions:

Alpine edge: busybox-1.37.0-r22
Alpine 3.22: busybox-1.37.0-r19
Alpine 3.21: busybox-1.37.0-r13
Alpine 3.20: busybox-1.36.1-r30
Alpine 3.19: busybox-1.36.1-r20

0001-tar-fix-TOCTOU-symlink-race-condition.patch « busybox « main - aports - Alpine packages build scripts

can't wait for someone to dub this "busybox-tar4shell"
@ariadne I'm sure this is a CVSS 9.8
@joshbressers i would say probably CVSS 6.5 or so. you have to already have the ability to untar a file somehow in the right place with effective root permissions. it's bad, but not the end of the world.

@ariadne Heh, I'm more joking that NVD seems to give everything a 9.8

I agree, this isn't a huge deal

@joshbressers i’ve debated changing my algorithm to guess severity ratings with “return 9.8” before
@ariadne I'm impressed that cgit just...doesn't show the removed lines in this patch
@endrift it's in aports, so aports tracks patch files, not patches themselves
@ariadne Hence I would expect it to show the whole file. But...it doesn't. It misses two lines.
@ariadne - flags = O_WRONLY | O_CREAT | O_TRUNC; + flags = O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW | O_EXCL;

And of course that doesn't looks correct… at least O_TRUNC and O_EXCL (fail if already exists) don't really go together.

@lanodan O_TRUNC preempts O_EXCL afaik
@lanodan nope, it is indeed the other way around…
@ariadne "You keep using that word. I don't think it means what you think it means."
@ariadne did they just report a vulnerability on a public mailing list? 
@ariadne oh fun seems like i already mitigated that one by accident when customizing my kernel a year ago