Description
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | busybox | 1:1.27.2-2 | — |
| Debian 13 | busybox | 1:1.27.2-2 | — |
| Debian 12 | busybox | 1:1.27.2-2 | — |
| Debian 9 | busybox | 1:1.22.0-19+deb9u1 | DLA-2559-1 |
| Debian 8 | busybox | 1:1.22.0-9+deb8u2 | DLA-1445-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | busybox | 1:1.27.2-1ubuntu4 | USN-3935-1 |
| Ubuntu 16.04 LTS | busybox | 1:1.22.0-15ubuntu1.4 | USN-3935-1 |
| Ubuntu 14.04 LTS | busybox | 1:1.21.0-1ubuntu1.4 | USN-3935-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | busybox | 1.35.0-150400.3.3.1 | SUSE-SU-2022:3959-1 |
| SLES 15 SP3 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SLES 15 SP2 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SLES 15 SP1 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SLES 15 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
Show 20 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | busybox | 1.35.0-4.3.1 | SUSE-SU-2022:4253-1 |
| SLES 12 SP4 | busybox | 1.35.0-4.3.1 | SUSE-SU-2022:4253-1 |
| SLES 12 SP3 | busybox | 1.35.0-4.3.1 | SUSE-SU-2022:4253-1 |
| SLES 12 SP2 | busybox | 1.35.0-4.3.1 | SUSE-SU-2022:4253-1 |
| SLES for SAP 15 SP2 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SLES for SAP 15 SP1 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SLES for SAP 15 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SLES for SAP 12 SP5 | busybox | 1.35.0-4.3.1 | SUSE-SU-2022:4253-1 |
| SLES for SAP 12 SP4 | busybox | 1.35.0-4.3.1 | SUSE-SU-2022:4253-1 |
| SLE Real Time 15 SP2 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-2 |
| SLE HPC 15 SP2 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SLE HPC 15 SP1 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SLE HPC 15 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SUSE OpenStack Cloud Crowbar 9 | busybox | 1.35.0-4.3.1 | SUSE-SU-2022:4253-1 |
| SUSE OpenStack Cloud 9 | busybox | 1.35.0-4.3.1 | SUSE-SU-2022:4253-1 |
| SUSE Manager Server 4.1 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SUSE Manager Retail Branch Server 4.1 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SUSE Manager Proxy 4.1 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SUSE Enterprise Storage 7 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
| SUSE Enterprise Storage 6 | busybox | 1.34.1-4.9.1 | SUSE-SU-2022:0135-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | busybox | 1.35.0-1.1 | openSUSE-SU-2024:11738-1 |
| openSUSE Leap 15.4 | busybox | 1.35.0-150400.3.3.1 | SUSE-SU-2022:3959-1 |
| openSUSE Leap 15.3 | busybox | 1.34.1-4.9.1 | openSUSE-SU-2022:0135-1 |
| openSUSE Leap 15.3 | virtualbox | 6.1.34-lp153.2.27.2 | openSUSE-SU-2022:0135-1 |
| openSUSE Leap 15.3 | virtualbox-kmp | 6.1.34-lp153.2.27.1 | openSUSE-SU-2022:0135-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | busybox | 1.27.2-r4 | — |
| Alpine v3.23 | busybox | 1.27.2-r4 | — |
| Alpine v3.22 | busybox | 1.27.2-r4 | — |
| Alpine v3.21 | busybox | 1.27.2-r4 | — |
| Alpine v3.20 | busybox | 1.27.2-r4 | — |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | busybox | 1.27.2-r4 | — |
| Alpine v3.18 | busybox | 1.27.2-r4 | — |
| Alpine v3.17 | busybox | 1.27.2-r4 | — |
| Alpine v3.16 | busybox | 1.27.2-r4 | — |
| Alpine v3.15 | busybox | 1.27.2-r4 | — |
| Alpine v3.14 | busybox | 1.27.2-r4 | — |
| Alpine v3.13 | busybox | 1.27.2-r4 | — |
| Alpine v3.12 | busybox | 1.27.2-r4 | — |
| Alpine v3.11 | busybox | 1.27.2-r4 | — |
| Alpine v3.10 | busybox | 1.27.2-r4 | — |
| Alpine v3.9 | busybox | 1.27.2-r4 | — |
| Alpine v3.8 | busybox | 1.27.2-r4 | — |
| Alpine v3.7 | busybox | 1.27.2-r4 | — |
| Alpine v3.6 | busybox | 1.26.2-r9 | — |
| Alpine v3.5 | busybox | 1.25.1-r1 | — |
| Alpine v3.4 | busybox | 1.24.2-r13 | — |
| Alpine v3.3 | busybox | 1.24.2-r2 | — |
Advisories 12
- DLA-2559-1 busybox - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1445-1 busybox - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3935-1 busybox vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2022:3959-1 Security update for busybox SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0135-2 Security update for busybox SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0135-1 Security update for busybox SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0135-1 Security update for busybox SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11738-1 busybox-1.35.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4253-1 Security update for busybox SUSE / openSUSE Security Updates · Feb 4, 2026
- VDE-2020-003 PHOENIX CONTACT: TC Router and TC Cloud Client multiple vulnerabilities CERT@VDE · May 14, 2025
- ICSA-20-240-01 Red Lion N-Tron 702-W, 702M12-W CISA ICS & IT advisories · Aug 27, 2020
- VDE-2019-013 WAGO: Multiple Vulnerabilities in industrial managed switches CERT@VDE · Jun 12, 2019
References
- https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/
- [debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update mailing-list
- https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8
- USN-3935-1 vendor-advisory
- 20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series mailing-list
- 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series mailing-list
- 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X mailing-list
- 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X mailing-list
- http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
- http://www.vmware.com/security/advisories/VMSA-2019-0013.html
- http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html
- 20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client mailing-list
- 20200827 SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S mailing-list
- https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01
- 20200902 SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W mailing-list
- 20210113 SEC Consult SA-20210113-0 :: Multiple vulnerabilities in Pepperl+Fuchs IO-Link Master Series mailing-list
- [debian-lts-announce] 20210215 [SECURITY] [DLA 2559-1] busybox security update mailing-list
- 20210819 SEC Consult SA-20210819-0 :: Multiple critical vulnerabilities in Altus Nexto and Hadron series mailing-list
- 20220617 SEC Consult SA-20220615-0 :: Hardcoded Backdoor User and Outdated Software Components in Nexans FTTO GigaSwitch series mailing-list
- http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html