CVE-2016-6301 — Infinite Loop in Busybox

CWE-399CWE-835 — Infinite Loop9 documents8 sources
Severity
7.5HIGHNVD
EPSS
3.3%
top 12.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
BusyboxDebian Busybox
Timeline
PublishedDec 9
Latest updateDec 29

Description

The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/busybox< busybox 1:1.27.2-1 (bookworm)
▶NVDbusybox/busybox< 1.25.1
▶Debianbusybox/busybox< 1:1.27.2-1+3

Patches

Patch: git.busybox.net ↗Patch: git.busybox.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-ww72-35h4-5v84: The recv_and_process_client_pkt function in networking/ntpd↗2022-05-13
▶
OSV
CVE-2016-6301: The recv_and_process_client_pkt function in networking/ntpd↗2016-12-09
▶

📋Vendor Advisories

3
CISA ICS
Advantech Spectre RT Industrial Routers↗2021-02-23
▶
Red Hat
busybox: NTP server denial of service flaw↗2016-08-03
▶
Debian
CVE-2016-6301: busybox - The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows ...↗2016
▶

📄Research Papers

1
arXiv
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware↗2022-12-29
▶

💬Community

2
Bugzilla
CVE-2016-6301 busybox: NTP server denial of service flaw↗2016-08-03
▶
Bugzilla
CVE-2016-6301 busybox: NTP server denial of service flaw [fedora-all]↗2016-08-03
▶