Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in BusyBox's volume_id HFS+ prober. A blocksize value of 0 in the volume header is used as a divisor, causing a divide-by-zero (SIGFPE) crash, and the catalog leaf_node_size is never validated, allowing a heap out-of-bounds read. A crafted HFS+ filesystem image on an attached device triggers these issues when probed by blkid, findfs or mount LABEL=/UUID=, causing the probing applet to crash and preventing device resolution.