Vulnerability Details CVE-2021-42382
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 42.1%
CVSS Severity
CVSS v3 Score 7.2
CVSS v2 Score 6.5
References
- https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
- https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
- https://security.netapp.com/advisory/ntap-20211223-0002/
- https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
- https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
- https://security.netapp.com/advisory/ntap-20211223-0002/
Products affected by CVE-2021-42382
-
cpe:2.3:a:busybox:busybox:1.26.0
-
cpe:2.3:a:busybox:busybox:1.26.1
-
cpe:2.3:a:busybox:busybox:1.26.2
-
cpe:2.3:a:busybox:busybox:1.27.0
-
cpe:2.3:a:busybox:busybox:1.27.1
-
cpe:2.3:a:busybox:busybox:1.27.2
-
cpe:2.3:a:busybox:busybox:1.28.0
-
cpe:2.3:a:busybox:busybox:1.28.1
-
cpe:2.3:a:busybox:busybox:1.28.2
-
cpe:2.3:a:busybox:busybox:1.28.3
-
cpe:2.3:a:busybox:busybox:1.28.4
-
cpe:2.3:a:busybox:busybox:1.29.0
-
cpe:2.3:a:busybox:busybox:1.29.1
-
cpe:2.3:a:busybox:busybox:1.29.2
-
cpe:2.3:a:busybox:busybox:1.29.3
-
cpe:2.3:a:busybox:busybox:1.30.0
-
cpe:2.3:a:busybox:busybox:1.30.1
-
cpe:2.3:a:busybox:busybox:1.31.0
-
cpe:2.3:a:busybox:busybox:1.31.1
-
cpe:2.3:a:busybox:busybox:1.32.0
-
cpe:2.3:a:busybox:busybox:1.32.1
-
cpe:2.3:a:busybox:busybox:1.33.0
-
cpe:2.3:a:busybox:busybox:1.33.1
-
cpe:2.3:o:fedoraproject:fedora:33
-
cpe:2.3:o:fedoraproject:fedora:34