Fluid Attacks Database

Description

The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	busybox	>=0 <1:1.22.0-15	1:1.22.0-15
debian 12	busybox	>=0 <1:1.22.0-15	1:1.22.0-15
debian 14	busybox	>=0 <1:1.22.0-15	1:1.22.0-15
debian 11	busybox	>=0 <1:1.22.0-15	1:1.22.0-15
rpm rhel5	busybox	-	-
rpm rhel6	busybox	-	-

Aliases

1. CVE-2014-96452. NVD-2014-96453. OSV-DEBIAN-2014-96454. OSV-2014-96455. SECURITY-TRACKER-CVE-2014-9645

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.