CVE-2023-43608

Name of the Vulnerable Software and Affected Versions Buildroot versions 2023.08.1 and dev commit 622698d7847

Description A data integrity issue exists in the BR NO CHECK HASH FOR functionality, allowing a specially crafted man-in-the-middle attack to lead to arbitrary command execution in the builder.

Recommendations For Buildroot version 2023.08.1, consider disabling the BR NO CHECK HASH FOR functionality until a patch is available. For dev commit 622698d7847, restrict access to the builder to minimize the risk of exploitation. As a temporary workaround, avoid using the BR NO CHECK HASH FOR functionality in the builder until the issue is resolved.