Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mirror/busybox
master @ 371fe9f
70
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Buffer Overflow: 28 prior fixes. Scrutinize any change in this area.
shell/ash.c: most-fixed (6 issues). Treat as high-risk during review.
58 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Buffer Overflow: The most common vulnerability class, driven by unsafe string functions (strcpy, strcat, sprintf) and fixed-size buffers across many utilities. Recurring pattern of missing bounds checks on user-controlled input lengths.
Use After Free / Use After Realloc: Memory corruption from dangling pointers after reallocation or freeing. Recurring in awk's evaluate() and shell variable/heredoc handling, indicating fragile pointer management in complex interpreters.
Path Traversal: Archive extraction and HTTP URL handling allow writing files outside intended directories via unsafe paths (.., absolute paths, symlinks). Multiple fixes across tar, unzip, and httpd indicate incomplete sanitization.