CVE-2024-58251 Denial of service in BusyBox
Local attackers can cause a denial of service by crafting network application arguments that lock up the terminal when netstat is executed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-58251?
CVE-2024-58251 is a low-severity denial of service vulnerability in BusyBox, published on 23 Apr 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
Weakness: CWE-150
Which versions are affected by CVE-2024-58251?
Linux distribution packages (18)
iproute2 SUSE:Linux Enterprise Micro 5.3 | All versions | 5.14-150400.3.6.1 |
net-tools SUSE:Linux Enterprise Micro 5.3 | All versions | 2.0+git20170221.479bb4a-150000.5.18.1 |
iproute2 SUSE:Linux Enterprise Micro 5.4 | All versions | 5.14-150400.3.6.1 |
net-tools SUSE:Linux Enterprise Micro 5.4 | All versions | 2.0+git20170221.479bb4a-150000.5.18.1 |
iproute2 SUSE:Linux Enterprise Micro 5.5 | All versions | 5.14-150400.3.6.1 |
net-tools SUSE:Linux Enterprise Micro 5.5 | All versions | 2.0+git20170221.479bb4a-150000.5.18.1 |
iproute2 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 6.4-150600.7.12.1 |
net-tools SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.0+git20170221.479bb4a-150000.5.18.1 |
net-tools SUSE:Linux Enterprise Module for Legacy 15 SP7 | All versions | 2.0+git20170221.479bb4a-150000.5.18.1 |
net-tools SUSE:Linux Enterprise Server 16.0 | All versions | 2.10-160000.4.1 |
iproute2 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 4.12-16.9.1 |
net-tools SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.60-765.20.1 |
net-tools SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.10-160000.4.1 |
net-tools SUSE:Linux Micro 6.0 | All versions | 2.10-5.1 |
net-tools SUSE:Linux Micro 6.1 | All versions | 2.10-slfo.1.1_3.1 |
net-tools SUSE:Linux Micro 6.2 | All versions | 2.10-160000.4.1 |
net-tools openSUSE:Leap 16.0 | All versions | 2.10-160000.4.1 |
net-tools openSUSE:Tumbleweed | All versions | 3.14~alpha~git.20251212.7011617-1.1 |
How do I fix CVE-2024-58251?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-58251 being exploited?
There is no known exploitation of CVE-2024-58251 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-58251, AZL-60933, AZL-61217, BELL-CVE-2024-58251, DEBIAN-CVE-2024-58251, ECHO-5f56-5dff-e960 and 20 more.