提交 #878212: BusyBox 1.30.1 NULL Pointer Dereference

A vulnerability was identified in BusyBox, affecting the wget applet when the timeout option -T is accepted while FEATURE_WGET_TIMEOUT is disabled at build time. In the affected configuration, wget still exposes the timeout option in its option string, but the corresponding storage target for the parsed integer becomes NULL because of conditional compilation.

As a result, invoking BusyBox wget with the -T option causes the generic BusyBox option parser to write the parsed integer value through a NULL pointer, leading to a segmentation fault and immediate process termination.

The issue was reproduced in BusyBox 1.30.1 as shipped by Ubuntu 22.04.5 LTS package 1:1.30.1-7ubuntu3.1 on amd64. The crash is triggered before any network activity is required, meaning the fault is fully local and can be reproduced with command-line input alone.

The root cause is an option/configuration mismatch. In networking/wget.c, the option string still includes the timeout option "T:+". However, the write-back destination for that option is conditionally compiled as IF_FEATURE_WGET_TIMEOUT(&G.timeout_seconds) IF_NOT_FEATURE_WGET_TIMEOUT(NULL). When FEATURE_WGET_TIMEOUT is disabled, the parser still accepts -T, but the integer write-back destination becomes NULL. The generic BusyBox option parsing logic then dereferences this NULL pointer while storing the parsed timeout value.

This results in a local denial of service affecting the wget process. No privilege escalation, arbitrary code execution, or information disclosure has been confirmed.
The issue has been notified via public issue: https://github.com/mirror/busybox/issues/124

• 来源: ⚠️ https://gist.github.com/wyxstarry/5c199ec824928c5ae5816aaecbc6df03
• 用户: yuxin_wang (UID 98928)
• 提交: 2026-07-02 15時39分 (2 月前)
• 管理: 2026-08-18 21時02分 (2 months later)
• 状态: 已接受
• VulDB条目: 391923 [BusyBox 直到 1.30.1 FEATURE_WGET_TIMEOUT networking/wget.c -T 拒绝服务]
• 积分: 20