🟡 Medium | Source: Microsoft Security Response Center
A use-after-free vulnerability in BusyBox v1.38.0 allows an attacker to crash affected systems by supplying a specially crafted AWK script, resulting in a Denial of Service. BusyBox is a widely used lightweight Unix toolset commonly found in Linux-based container images and embedded systems. This vulnerability is relevant to Azure and cloud workloads that run containers built on minimal Linux distributions incorporating BusyBox.
Security Architect’s Take: Audit your container base images and any Azure-hosted workloads for BusyBox v1.38.0 and upgrade to a patched version promptly; also review your container image scanning pipeline to ensure vulnerable BusyBox versions are flagged before deployment.