CVE-2026-124742

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-124742", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-11-09T11:36:29.478Z", "datePublished": "2026-11-11T11:19:54.026Z", "dateUpdated": "2026-11-13T13:32:57.527Z"}, "containers": {"cna": {"title": "Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "busybox-main", "defaultStatus": "affected", "versions": [{"version": "1.37.0-9.5.hum1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:hummingbird:1"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "busybox", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:rhel_els:6"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:99577", "name": "RHSA-2026:99577", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-124742", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571620", "name": "RHBZ#2571620", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/vda-linux/busybox_mirror/commit/b7c89c4"}], "datePublic": "2026-11-11T09:15:15.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-369", "description": "Divide By Zero", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-369: Divide By Zero", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-10-25T13:38:36.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-11T09:15:15.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Duc Anh Luu for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-13T13:32:57.527Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "busybox-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.37.0-9.5.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unknown", "packageName": "busybox", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations."}], "id": "CVE-2026-124742", "lastModified": "2026-11-13T14:17:50.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}]}, "published": "2026-11-11T12:19:47.867", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99577"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-124742"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571620"}, {"source": "secalert@redhat.com", "url": "https://github.com/vda-linux/busybox_mirror/commit/b7c89c4"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-369"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank ducanhluu for reporting this issue.", "bugzilla": {"description": "busybox: Divide-by-zero in the volume_id FAT prober via a zero sectors_per_cluster value", "id": "2571620", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571620"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-369", "details": ["A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-124742", "package_state": [{"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Out of support scope", "package_name": "busybox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "busybox", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-11T09:15:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-124742\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-124742\nhttps://github.com/vda-linux/busybox_mirror/commit/b7c89c4"], "statement": "This vulnerability is rated as Moderate severity because it requires local access or the introduction of a specially crafted block device to trigger an unhandled application crash, presenting a denial-of-service risk rather than arbitrary code execution. In standard Red Hat Enterprise Linux environments, core storage probing and mounting utilities are provided by util-linux rather than BusyBox, which confines exposure to specific recovery environments or minimal container images. In those contexts, an attacker would need the ability to supply untrusted storage media to disrupt device resolution during boot or hotplug handling.", "threat_severity": "Moderate"}

{"created": "2026-11-12T00:15:09.849410+00:00", "updated": "2026-11-13T13:45:21.978261+00:00", "vendors": []}