CVE-2023-45839 Code injection in Buildroot
A man-in-the-middle attack can exploit hash checking flaws in Buildroot to execute arbitrary commands during the build process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-45839?
CVE-2023-45839 is a high-severity code injection vulnerability in Buildroot, published on 5 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `aufs-util` package.
Weakness: CWE-494
Which versions are affected by CVE-2023-45839?
It affects 1 product.
Products include Buildroot Buildroot.
How do I fix CVE-2023-45839?
No fix has been published for CVE-2023-45839 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-45839 being exploited?
There is no known exploitation of CVE-2023-45839 in the wild and no public exploit code.
Other vulnerabilities in Buildroot
Sources
Also known as GHSA-qfxp-hcq8-c568.