Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in BusyBox's volume_id. In volume_id_get_buffer(), a 64-bit offset+length addition can wrap past 2^64, passing the buffer size check and returning a pointer far outside the buffer, which the NTFS prober dereferences, causing a SIGSEGV crash. A crafted filesystem image on an attached device triggers this when probed by blkid, findfs or mount LABEL=/UUID=, preventing those applets from resolving any device.