security alerts in busybox

[Roberto A. Foglietta]

On Fri, 24 Apr 2026 at 19:02, Aaro Koskinen <aaro.koskinen at iki.fi> wrote:
>
> Hi,
>
> On Fri, Apr 24, 2026 at 04:40:47PM +0200, Roberto A. Foglietta via busybox wrote:
> > Are these false positives? Well, it is more about corner cases like
> > using the applet in a strong parallel mode like xargs -p8 does. If
> > used for maintenance on a large enough infrastructure, the corner case
> > has a chance to be met, for example.
>
> Busybox doesn't create threads, so ctime() is not a problem. I think
> you meant xargs -P and that forks.
>

Correct. AFAIK. Once compiled static for a specific well-known
well-tested target arch, the issue does not exist anymore.

So it was a false positive? A totally theoretical risk? Unless proven
differently, I support the idea of the false positive but...

self-contained, nommu-vfork, libc-pthreaded

Therefore my previous e-mail was containing this passare (1) --> (2)

(1) These are trivial alerts, therefore I faced it first to provide an
example. [...] And the second main question is straightforward: (2)
does this fix worth 177 bytes? In relative terms it is 150 ppm
compared with the full size footprint. In terms of certifications is a
solid step towards peace of mind.

Best regards, R-