CVE-2023-43608
📋 TL;DR
A data integrity vulnerability in Buildroot's BR_NO_CHECK_HASH_FOR functionality allows man-in-the-middle attackers to bypass hash verification during package downloads. This can lead to arbitrary command execution on Buildroot builder systems. Affects Buildroot 2023.08.1 and development versions.
💻 Affected Systems
- Buildroot
📦 What is this software?
Buildroot by Buildroot
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of Buildroot builder systems leading to supply chain attacks, backdoored firmware images, and lateral movement to connected systems.
Likely Case
Attackers inject malicious packages during downloads, executing arbitrary commands on builder systems to steal credentials, modify builds, or establish persistence.
If Mitigated
Limited impact with proper network segmentation, TLS verification, and isolated build environments preventing command execution.
🎯 Exploit Status
Requires man-in-the-middle position on network traffic between Buildroot and package repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in Buildroot commit after 622698d7847
Vendor Advisory: http://www.openwall.com/lists/oss-security/2023/12/11/1
Restart Required: No
Instructions:
1. Update Buildroot to latest version. 2. Remove BR_NO_CHECK_HASH_FOR usage. 3. Verify package hashes are properly checked.
🔧 Temporary Workarounds
Disable BR_NO_CHECK_HASH_FOR
linuxRemove or comment out BR_NO_CHECK_HASH_FOR usage in Buildroot configuration
# Remove lines containing BR_NO_CHECK_HASH_FOR from .config or defconfig files
Use secure package sources
linuxConfigure Buildroot to download packages only from HTTPS/TLS-secured repositories
# Ensure BR2_PRIMARY_SITE uses https:// URLs
🧯 If You Can't Patch
- Network segmentation: Isolate Buildroot builders from untrusted networks
- Monitor downloads: Implement network monitoring for unexpected package downloads or hash verification failures
🔍 How to Verify
Check if Vulnerable:
Check if BR_NO_CHECK_HASH_FOR is set in Buildroot configuration: grep -r BR_NO_CHECK_HASH_FOR .config buildroot/Check Version:
make -C buildroot/ version | grep 'Buildroot'Verify Fix Applied:
Verify BR_NO_CHECK_HASH_FOR is not present and Buildroot version is updated: make -C buildroot/ version📡 Detection & Monitoring
Log Indicators:
- Hash verification failures in Buildroot logs
- Unexpected package downloads or sizes
Network Indicators:
- Unencrypted HTTP downloads of Buildroot packages
- Suspicious MITM activity on build network
SIEM Query:
source="buildroot.log" AND ("hash mismatch" OR "verification failed")🔗 References
- http://www.openwall.com/lists/oss-security/2023/12/11/1
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1845
- http://www.openwall.com/lists/oss-security/2023/12/11/1
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1845
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1845
