CVE-2021-42377: busybox Free of Memory not on the Heap
CVSS: 9.8v3.1CriticalModified
AliasesALPINE-CVE-2021-42377UBUNTU-CVE-2021-42377DEBIAN-CVE-2021-42377
Published 15-11-2021Last modified 04-08-2024
Vulnerability summary
CVE-2021-42377 is a critical (CVSS 9.8) Free of Memory not on the Heap vulnerability in busybox. EPSS estimates a 3.62% chance of exploitation in the next 30 days, higher than 89.3% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
3.62%
0%100%
Low · -0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 6Timeline
- 15-11-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
3.62%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
-0.02 pp
From 3.63% on 18-09-2026
18-09-202618-10-2026
EPSS score3.62%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-590Free of Memory not on the HeapThe product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
- CWE-763Release of Invalid Pointer or ReferenceThe product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
Affected systems
Alpine1 product
- busyboxAll versions (No fix recorded)
Busybox1 product
- busybox≥ unspecified, < 1.34.0 | 1.33.0 | 1.33.1
Debian1 product
- busybox< 1:1.35.0-1
Fedoraproject1 product
- fedoraEOL33 | 34
Ubuntu1 product
- busybox< 1:1.27.2-2ubuntu3.3 | < 1:1.30.1-4ubuntu6.3 | < 1:1.30.1-6ubuntu3
6 vendors · 15 products
References
9 links- jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/REPORTThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- security.netapp.com/advisory/ntap-20211223-0002/Third Party Advisory
