14125 2020-11-12 15:45:28 +0000 busybox wget ssl is exposed to MitM attack due to CVE-2018-1000500 2024-07-18 17:26:17 +0000 1 1 11 Runtime Security security unspecified All Multiple RESOLVED FIXED Medium+ normal 5.1 M2 1 shachar randy.macleod akuster808 randy.macleod richard.purdie ross.burton shachar tgamblin --- --- No (bug/feature does not impact docs) oldest_to_newest 88599 0 shachar 2020-11-12 15:45:28 +0000 The version of busybox shipped with Yocto builds (which is 1.31.1) is exposed to a severe CVE which easily allows for SSL MitM attacks (when using busybox wget) To remediate, the following steps need to be done: 1. Update busybox to version 1.32.0 2. Change busybox build configuration (ex. https://git.yoctoproject.org/cgit/cgit.cgi/poky/tree/meta-poky/recipes-core/busybox/busybox/poky-tiny/defconfig?h=dunfell) to: CONFIG_FEATURE_WGET_OPENSSL=y # CONFIG_FEATURE_WGET_HTTPS is not set 88709 1 akuster808 2020-12-03 15:26:18 +0000 Master and gatesgarth are both at 1.32.0. 1) action to send config change Dunfell is at 1.31.1 an may or may not be able to be updated. It will need #1 and a source change patch or otherwise. 88749 2 ross.burton 2020-12-10 15:54:40 +0000 Either way we might want to apply this patch from Alpine which prints a big warning when using the insecure codepaths: https://github.com/alpinelinux/aports/commit/a93da0e814c542ff3a76cba0b557ee51c8124d1e I'd say that telling the user that their connection isn't being verified is enough to mitigate the CVE, as the issue is that MitM can happen without your knowledge. 88768 3 akuster808 2020-12-11 23:43:31 +0000 As this is a team effort, i will take the next step and send a patch to move us to the next step of resolving this issue. I have a few options to select from. 88769 4 shachar 2020-12-12 14:37:10 +0000 I sent the patch a few weeks ago, but got pushback because it required building the "openssl" binary and not just the library (that's just how the busybox team chose to use openssl unfortunately... not through the library but by calling the binary) 88937 5 akuster808 2021-01-14 16:17:21 +0000 This is the patch. https://lists.yoctoproject.org/g/yocto-security/message/229 sent to the security-list. 88939 6 akuster808 2021-01-14 16:22:57 +0000 In master. https://git.openembedded.org/openembedded-core/commit/meta/recipes-connectivity/openssl?id=304417a97db89d9ea4a41aa7c92b5a052896d63b 88941 7 akuster808 2021-01-14 16:33:26 +0000 I think this can be marked as fixed. 88943 8 randy.macleod 2021-01-14 17:05:41 +0000 Are the backports done or going to happen? 88975 9 akuster808 2021-01-21 15:32:39 +0000 (In reply to comment #8) > Are the backports done or going to happen? Its not obvious in the commit that its addressing a CVE so a backport request needs to be sent to the list. 89006 10 shachar 2021-01-23 20:55:30 +0000 I think there's been a bit of a mixup The patch referenced in this thread before (this one - https://lists.yoctoproject.org/g/yocto-security/message/229) DOESN'T resolve the CVE. It's related to a different issue. Resolving the CVE requires: 1. Changing the busybox config to use OpenSSL by enabling CONFIG_FEATURE_WGET_OPENSSL 2. Building the openssl executable (today it's being built as a library only, but busybox uses openssl as an executable when CONFIG_FEATURE_WGET_OPENSSL is enabled) So I wrote the patch for #1 a while back, but then got pushback regarding point #2, and didn't submit it, since I thought we're going with Ross' suggestion of just including a warning, the alpine patch - https://github.com/alpinelinux/aports/commit/a93da0e814c542ff3a76cba0b557ee51c8124d1e 89642 11 randy.macleod 2021-03-18 14:37:53 +0000 Shakar, Can you send a patch to at least issue a warning? 89963 12 randy.macleod 2021-04-15 18:28:01 +0000 The discussion on the email list wasn't conclusive. Do you want to drop the issue or add a PACKAGECONFIG to make busybox wget secure using openssl. I suspect that making it secure by default will not be viable due to pulling in some of openssl but that's just my opinion. 89964 13 akuster808 2021-04-15 21:24:42 +0000 (In reply to comment #12) > The discussion on the email list wasn't conclusive. Do you want to drop the > issue or add a PACKAGECONFIG to make busybox wget secure using openssl. I > suspect that making it secure by default will not be viable due to pulling > in some of openssl but that's just my opinion. I have been wondering if something like defining something at the DISTRO level to enable mitigation of this CVE so folks can OPT in knowing the affects of doing so then we could have Busybox and openssl do the appropriate things based on that OPT in directive? I know the kernel has done this from time to time. The early Meltdown & Sepectra come to mind. 89979 14 shachar 2021-04-17 11:26:10 +0000 Hey guys, I looked into it further and it seems the "issue" with openssl and the yocto build is not that it's compiled without the binary part, but rather that in "core-image-base" and "core-image-minimal" openssl is not getting compiled at all, and thus busybox wget will not be able to rely on it I think that adding openssl to minimal builds will cause a lot of friction in the community, so I'd rather not go that path I suggest that to cause the least amount of friction, I will submit a patch that enables busybox's CONFIG_FEATURE_WGET_OPENSSL for all builds This means that in builds WITH openssl (ex. sato) the issue will be completely fixed, and in builds WITHOUT openssl, busybox will fallback to using the internal (insecure) client which will print out a message "note: TLS certificate validation not implemented" Also note that busybox does not rely in any way on the OpenSSL library (it just executes the standalone binary, if it is found) so we shouldn't have linkage issues is CONFIG_FEATURE_WGET_OPENSSL is enabled but OpenSSL is not getting built WDYT? Makes sense? 89980 15 shachar 2021-04-17 14:41:29 +0000 Sent to yocto-security https://lists.yoctoproject.org/g/yocto-security/topic/patch_busybox_use_openssl/82166345?p=,,,20,0,0,0::recentpostdate%2Fsticky,,,20,2,0,82166345 90015 16 randy.macleod 2021-04-20 01:27:42 +0000 Makes sense to me. Thanks Shachar. 90016 17 randy.macleod 2021-04-20 01:29:50 +0000 I don't see the patch yet (21:30 ET). Maybe it's in the mail! ;-) 90018 18 shachar 2021-04-20 06:03:55 +0000 Oh, just look at the link I sent - https://lists.yoctoproject.org/g/yocto-security/topic/patch_busybox_use_openssl/82166345?p=,,,20,0,0,0::recentpostdate%2Fsticky,,,20,2,0,82166345 Again, in this case the patch really comes out as minimal (just enabling CONFIG_FEATURE_WGET_OPENSSL for all builds) 90030 19 shachar 2021-04-20 18:49:44 +0000 Some extra information about the patch I submitted - By enabling the busybox feature CONFIG_FEATURE_WGET_OPENSSL, in builds WITH openssl (ex. "sato" build) the issue will be completely fixed, and in builds WITHOUT openssl, busybox will fallback to using the internal (insecure) client which will print out a message "note: TLS certificate validation not implemented" Note that busybox does not rely in any way on the OpenSSL library (it just executes the standalone binary, if it is found) so we shouldn't have linkage issues if CONFIG_FEATURE_WGET_OPENSSL is enabled but OpenSSL is not getting built in this particular build (ex. "minimal" build) 90153 20 randy.macleod 2021-04-29 14:37:26 +0000 Shachar, it seems like you have agreement with Andre so I'm moving this to 3.4-M1. 91179 21 akuster808 2021-08-12 22:19:15 +0000 the busybox fix to address this is: https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91 91180 22 randy.macleod 2021-08-12 23:29:45 +0000 Thanks Armin. $ cd .../busybox.git && git pull $ git branch -a --contains 45fa3f18adf57ef9d743038743d9c90573aeeb91 * 1_33_stable master remotes/origin/1_32_stable remotes/origin/1_33_stable remotes/origin/HEAD -> origin/master remotes/origin/master $ git tag --contains 45fa3f18adf57ef9d743038743d9c90573aeeb91 1_32_0 1_32_1 1_33_0 1_33_1 and we have 1.33.1: http://cgit.openembedded.org/openembedded-core/commit/meta/recipes-core/busybox/busybox_1.33.1.bb?id=544236b12a72ee5be5ef0147249ead112082b871 so the questions I have are: 1. is the code is enabled for YP by default and 2. do we want to backport the fix to previous releases? 91276 23 akuster808 2021-08-26 14:31:46 +0000 (In reply to comment #22) > Thanks Armin. > > $ cd .../busybox.git && git pull > $ git branch -a --contains 45fa3f18adf57ef9d743038743d9c90573aeeb91 > * 1_33_stable > master > remotes/origin/1_32_stable > remotes/origin/1_33_stable > remotes/origin/HEAD -> origin/master > remotes/origin/master > $ git tag --contains 45fa3f18adf57ef9d743038743d9c90573aeeb91 > 1_32_0 > 1_32_1 > 1_33_0 > 1_33_1 > > and we have 1.33.1: > http://cgit.openembedded.org/openembedded-core/commit/meta/recipes-core/ > busybox/busybox_1.33.1.bb?id=544236b12a72ee5be5ef0147249ead112082b871 > > so the questions I have are: > 1. is the code is enabled for YP by default and > 2. do we want to backport the fix to previous releases? Hardknott 1.32.0 Dunfell 1.31.1 so dunfell needs this. I can send a patch for dunfell 91800 24 randy.macleod 2021-10-21 14:35:39 +0000 Shakjar, Armin, Do we have consensus about how to handle this bug? I'm reluctant to keep moving the bug to newer releases... 91819 25 shachar 2021-10-21 21:42:23 +0000 Armin, do you think it makes sense to replace BusyBox's wget with GNU wget? (I see there's already a recipe for that) This should solve the issue and retain compatibility 93369 26 randy.macleod 2022-06-02 14:34:42 +0000 We think this is fixed in newer busybox releases. Armin to look into it. 94210 27 randy.macleod 2022-10-20 14:33:46 +0000 This may have been fixed. I just have to find the time to confirm. 95350 28 randy.macleod 2023-04-13 14:27:11 +0000 From a recent poky build: $ grep WGET_OPENSSL tmp/work/core2-64-poky-linux/busybox/1.36.0-r0/busybox-1.36.0/.config # CONFIG_FEATURE_WGET_OPENSSL is not set I'll enable it and send a patch. 99380 29 richard.purdie 2024-07-12 13:52:15 +0000 Patch sent for master to switch to the openssl option. 99416 30 randy.macleod 2024-07-18 17:26:17 +0000 Fixed by Richard - Thanks!!! https://git.openembedded.org/openembedded-core/commit/?id=5d4ad13462f12355ff0f2bc1773ab4b1814b165a