CVE-2016-6301: busybox Resource Management Errors
CVSS: 7.8v2.0HighModified
AliasesALPINE-CVE-2016-6301MGASA-2016-0277DEBIAN-CVE-2016-6301
Published 09-12-2016Last modified 04-12-2025
Vulnerability summary
CVE-2016-6301 is a high (CVSS 7.8) Resource Management Errors vulnerability in busybox. EPSS estimates a 8.97% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v2.0 (NVD)EPSS score
8.97%
0%100%
Low · +0.07 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 09-12-2016PublishedVulnerability first disclosed.
- 04-12-2025Last modifiedVulnerability information updated.
Description
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.
CVSS metrics
6 scores · 4 sources · 3 versionsHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 2 agree
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.8Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:CSourcesSingle source
EPSS trend
Probability
8.97%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
+0.07 pp
From 8.89% on 18-09-2026
18-09-202618-10-2026
EPSS score8.97%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mageia2 products
- busybox< 1.22.1-5.3.mga5
- openntpd< 3.9p1-11.1.mga5
Alpine1 product
- busybox< 1.24.2-r1 | < 1.24.2-r12 | < 1.25.0-r0
Busybox1 product
- busybox< 1.25.1
Debian1 product
- busybox< 1:1.27.2-1
4 vendors · 5 products
References
17 links- bugzilla.redhat.com/show_bug.cgi?id=1363710X Refsource CONFIRMIssue TrackingThird Party AdvisoryREPORT
- git.busybox.net/busybox/commit/?id=150dc7a2b483b8338a3e185c478b4b23ee884e71X Refsource CONFIRMIssue TrackingPatch
- packetstormsecurity.com/files/…X Refsource MISC
