Hey all, I added what I hope is a correct analysis in the bug description. ** Description changed:
busybox 1:1.37.0-10.1ubuntu3 removed the busybox-initramfs package (that was in main) in favour of just using the busybox package (in universe) in the initrd. See bug #2157328 for details. Please promote the busybox binary to main. I haven't found any history busybox MIR bugs. IMO we should do a re-review of busybox, but do not block promoting busybox for the stonking release. + + EDIT BY PEB: + MIR report for source package: busybox + Target series: Ubuntu 26.10 (Stonking) + Assessed version: 1:1.38.0-3ubuntu3 (stonking-proposed) + Existing MIR: https://bugs.launchpad.net/ubuntu/+source/busybox/+bug/2166895 + + This completes this MIR + + [Availability] + - src:busybox is already published in main. + - Current Launchpad builds pass on: amd64, amd64v3, arm64, armhf, i386, ppc64el, riscv64, s390x. + - Source package: https://launchpad.net/ubuntu/+source/busybox + + [Rationale] + - This report complements this MIR to request promotion of bin:busybox; + src:busybox is already in main. No sibling binary package is requested for + promotion in this supplement. + - bin:busybox is required following removal of busybox-initramfs in favour of + busybox itself. Its promotion preserves the BusyBox functionality available + for initramfs operation and recovery in Resolute. dracut-core recommends + busybox. + - BusyBox is not proposed as a replacement for klibc-utils. Although both + provide utilities used during early boot, klibc-utils supplies a smaller, + boot-oriented command set and is not a drop-in replacement for the BusyBox + environment previously provided by busybox-initramfs. For example, + klibc-utils does not provide grep, sed, awk, find or tar. These examples + illustrate the difference in functionality, rather than implying that every + command is required for boot. + Reference: https://packages.debian.org/sid/amd64/klibc-utils/filelist + + [Security] + - No AppArmor profiles or plugin candidates were found in the collected + package inspection. + - The detected service units belong to sibling packages: udhcpd.service to + udhcpd, and busybox-syslogd.service and busybox-klogd.service to + busybox-syslogd. These provide DHCP-server, system-log and kernel-log + services respectively. Those packages are not requested for promotion here. + The presence of daemon applets in bin:busybox does not by itself mean that + these services are installed or enabled. + - Source searches identified MD5/SHA1 references in ntpd. Search hits and the + absence of AppArmor profiles alone do not establish an exploitable issue. + Applicability depends on enabled functionality and its use. + - The collected Ubuntu CVE results concern Resolute, not the target Stonking + series. The corresponding public Resolute records distinguish four fixed, + four vulnerable and eight needing evaluation. The collector grouped the + latter two categories as "vulnerable". No Stonking disposition was available + in the retrieved Ubuntu tables. + - The table below distinguishes those Ubuntu dispositions from evidence + concerning upstream BusyBox 1.38.0. Several cited fixes are already included + upstream. Four CVE records explicitly include 1.38.0 in their affected + versions. These are not final dispositions for Ubuntu 1:1.38.0-3ubuntu3: + applicability to the proposed binary depends on its packaged patches and + enabled applets. + + | CVE / reference | Applet and issue | Ubuntu Resolute status | Evidence relevant to upstream 1.38.0 | + |---|---|---|---| + | [CVE-2022-48174](https://ubuntu.com/security/CVE-2022-48174) | Shell arithmetic: stack overflow | Fixed in 1:1.36.1-6ubuntu4 | Cited corrective commit included. | + | [CVE-2023-42363](https://ubuntu.com/security/CVE-2023-42363) | awk: use-after-free | Fixed in 1:1.36.1-6ubuntu4 | Cited corrective commit included. | + | [CVE-2023-42364](https://ubuntu.com/security/CVE-2023-42364) | awk: use-after-free in evaluate() | Fixed in 1:1.36.1-6ubuntu4 | Linked corrective commits included, including follow-up remediation. | + | [CVE-2023-42365](https://ubuntu.com/security/CVE-2023-42365) | awk: use-after-free in copyvar() | Fixed in 1:1.36.1-6ubuntu4 | Ubuntu documents shared remediation with CVE-2023-42364. | + | [CVE-2023-42366](https://ubuntu.com/security/CVE-2023-42366) | awk: heap-buffer overflow in next_token() | Vulnerable | Unresolved here. Ubuntu notes proposed Debian fixes in 1:1.37.0-10; target-package inclusion is not established. | + | [CVE-2024-58251](https://ubuntu.com/security/CVE-2024-58251) | netstat: terminal escape injection through process names | Vulnerable | Unresolved here. Published affected range ends at 1.37.0; this does not establish whether 1.38.0 is fixed. | + | [CVE-2025-46394](https://ubuntu.com/security/CVE-2025-46394) | tar: terminal escape sequences conceal archive filenames | Vulnerable | Unresolved here. 1.38.0 release notes mention filename-output sanitization, but an explicit CVE-to-fix mapping was not established. | + | [CVE-2025-60876](https://ubuntu.com/security/CVE-2025-60876) | wget: HTTP request/header injection through control characters | Vulnerable | Unresolved here. Ubuntu notes proposed Debian fixes in 1:1.37.0-10; target-package inclusion is not established. | + | [CVE-2026-26157](https://ubuntu.com/security/CVE-2026-26157) | Archive extraction: insufficient path sanitization | Needs evaluation | Cited fix included in 1.38.0: 3fb6b31c. | + | [CVE-2026-26158](https://ubuntu.com/security/CVE-2026-26158) | tar: link handling permits writes outside extraction directory | Needs evaluation | Same cited fix included in 1.38.0: 3fb6b31c. | + | [CVE-2026-29004](https://ubuntu.com/security/CVE-2026-29004) | udhcpc6: heap-buffer overflow parsing DHCPv6 DNS-server options | Needs evaluation | Cited fix included in 1.38.0: 42202bfb. | + | [CVE-2026-38752](https://ubuntu.com/security/CVE-2026-38752) | awk: stack overflow in evaluate() | Needs evaluation | CNA affected range explicitly includes 1.38.0. Ubuntu patch/configuration disposition remains unestablished. | + | [CVE-2026-38753](https://ubuntu.com/security/CVE-2026-38753) | awk: use-after-free in awk_sub() | Needs evaluation | CNA explicitly identifies 1.38.0 as affected. Ubuntu patch/configuration disposition remains unestablished. | + | [CVE-2026-38754](https://ubuntu.com/security/CVE-2026-38754) | ash: heap overflow in ifsbreakup() | Needs evaluation | CNA explicitly identifies 1.38.0 as affected. Ubuntu patch/configuration disposition remains unestablished. | + | [CVE-2026-38755](https://ubuntu.com/security/CVE-2026-38755) | ash: heap overflow in evalcommand() | Needs evaluation | CNA explicitly identifies 1.38.0 as affected. Ubuntu patch/configuration disposition remains unestablished. | + | [CVE-2026-76014](https://ubuntu.com/security/CVE-2026-76014) | wget: timeout handling can cause a null-pointer dereference | Needs evaluation | Unresolved here. Record identifies older versions and a patch, but its inclusion in 1.38.0 was not established. | + + Upstream release references: + https://busybox.net/ + https://github.com/vda-linux/busybox_mirror/compare/3fb6b31c716669e12f75a2accd31bb7685b1a1cb...1_38_0 + https://github.com/vda-linux/busybox_mirror/compare/42202bfb1e6ac51fa995beda8be4d7b654aeee2a...1_38_0 + + [Quality assurance - function/usage] + - The package works well right after install + + [Quality assurance - maintenance] + - The collected Launchpad query returned no critical Ubuntu bugs; the + collected Debian BTS query returned no open bugs, including release-critical + bugs. These observations reflect the queries' coverage. + - The package does not depend on exotic hardware we cannot support. + - The package tracks upstream version 1.38.0. Launchpad records recent Ubuntu + uploads, including 1:1.38.0-3ubuntu3 published in stonking-proposed on + 2026-09-14. Distribution upload/publication history is not treated as an + upstream release-cadence measurement. + - The collected Launchpad query returned 40 open bugs. The oldest date from + 2007. The only open bug returned as security-related dates from 2015 and + references CVE-2015-0235. This bug-query result is separate from the CVE + dispositions discussed in the Security section. + + [Quality assurance - testing] + - The package runs an upstream build-time test suite through debian/rules, + covering functional behavior of applets such as awk, cut, dd and grep. + No package-specific autopkgtests are currently defined, and no commitment + to add them is made in this request. + - Build-time tests are executed and captured in the build log: + + ======== running testsuite in b/deb ======== + cd b/deb/testsuite && SKIP_KNOWN_BUGS=y LANG=C.UTF-8 LC_ALL=C.UTF-8 SKIP_INTERNET_TESTS=y SHELL='/bin/sh -e' ECHO=/bin/echo ./runtest + PASS: busybox as unknown name + PASS: busybox --help busybox + PASS: busybox + PASS: busybox unknown + PASS: busybox --help + PASS: busybox cat + PASS: busybox --help cat + PASS: busybox --help unknown + [...] + - Autopkgtest implementation has been submitted in the following MP: https://code.launchpad.net/~peb/ubuntu/+source/busybox/+git/busybox/+merge/511521 but there is none in the current package in stonking. + - Build-time applet coverage does not by itself establish initramfs integration + coverage. Acceptance of the existing coverage is left to the MIR reviewers. + + [Quality assurance - packaging] + - A debian/watch upstream-release mechanism is present. + - debian/control defines a correct Maintainer field + - Lintian reported 0 error(s) and 0 warning(s). + - No Python 2, GTK 2, or other catalogued obsolete runtime dependency was found. + - Source format: 3.0 (quilt). Debconf templates: 0; debian/rules overrides: dh_auto_install, dh_installsystemd. + - Packaging supports separate deb, static and udeb build flavours, generates + and verifies their configurations, and integrates the upstream kbuild + system. These requirements account for the custom logic in debian/rules. + + [UI standards] + - This package is not end-user facing (server, CLI-only tool, daemon, or library), so desktop-file and translation requirements do not apply. + (Busybox is a collection of standard UNIX command-line utilities (e.g., ls, cat, cp, ash) and system daemons (e.g., syslogd, udhcpd). The binary sections are 'utils', 'shells', 'debian-installer', and 'net', which are typical for system utilities and not graphical applications. The runtime dependencies consist only of libc6, with no GUI toolkits such as GTK or Qt. Additionally, there are no desktop files, and the presence of systemd units (e.g., udhcpd.service, busybox-syslogd.service) confirms its role as a CLI-only tool and daemon suite.) + - Not an end-user application (server, CLI-only tool, or library) - no Desktop file is needed. + - Application is not end-user facing (does not need translation). + + [Dependencies] + - No in-scope runtime dependencies outside main require a separate MIR. + + [Standards compliance] + - This package correctly follows FHS and Debian Policy. + - No license expiry, time-bound terms, entity/contract coupling, withdrawable + branches, patents, or other encumbrances were identified. The license is + expected to remain compatible with Ubuntu main throughout the full support + lifetime. + + [Maintenance/Owner] + - Package bug subscriber team(s): debcrafters-packages. + - No shipped vendored directories were detected. + - Build information for the assessed upload: + https://launchpad.net/ubuntu/+source/busybox/1:1.38.0-3ubuntu3 + The collected data contains eight architecture records referencing seven + distinct build URLs. These describe build coverage for one upload, not + maintenance cadence. + - The initramfs transition affects consumers including dracut, + initramfs-tools, casper and cryptsetup. No claim of zero impact on other + Ubuntu teams is made here. + - busybox-static declares Built-Using: glibc (= 2.44-1ubuntu1). This declaration + belongs to that sibling package, not the requested bin:busybox, whose + inspected metadata declares neither Built-Using nor Static-Built-Using. + + [Background information] + - The upstream project is BusyBox, which is the same as the source package name. + (The upstream-tracker data explicitly lists the upstream name as 'busybox' and provides the URL 'https://www.busybox.net'. The debian_control Source field is 'busybox', matching the upstream name.) + - Upstream project: https://www.busybox.net + - The package description explains the package well ** Changed in: busybox (Ubuntu) Status: In Progress => Fix Committed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166895 Title: [MIR] busybox To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/busybox/+bug/2166895/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
