CVE-2021-42374 Information disclosure in busybox

What is CVE-2021-42374?

CVE-2021-42374 is a medium-severity vulnerability in Fedoraproject Fedora, published on 15 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that

Weakness: CWE-125

Which versions are affected by CVE-2021-42374?

It affects 12 products.

Products include Busybox Busybox, Fedoraproject Fedora, Netapp Cloud Backup, Netapp H300e Firmware, Netapp H300s Firmware, Netapp H410s Firmware and 6 more.

How do I fix CVE-2021-42374?

Apply the vendor's patch.

Is CVE-2021-42374 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-42374 exists.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2022-48174 Memory corruption in n/a Critical 9.8
• CVE-2021-42377 Memory corruption in busybox Critical 9.8
• CVE-2016-2148 Memory corruption in n/a Critical 9.8
• CVE-2022-28391 Command injection in n/a High 8.8
• CVE-2017-16544 Code injection in n/a High 8.8

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2021-42374, AZL-41054, AZL-6343, DEBIAN-CVE-2021-42374, GHSA-6f92-r9cq-v6cq, OESA-2021-1441 and 1 more.