CVE-2021-42377 Memory corruption in busybox

Critical 9.8 Published 15 Nov 2021 Updated 4 Aug 2024

An attacker can cause denial of service or execute code by exploiting a memory corruption flaw in BusyBox's hush shell when processing specific commands.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-42377?

CVE-2021-42377 is a critical memory corruption vulnerability in Fedoraproject Fedora, published on 15 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.

Weakness: CWE-763, CWE-590

Which versions are affected by CVE-2021-42377?

It affects 12 products.

Products include Busybox Busybox, Fedoraproject Fedora, Netapp Cloud Backup, Netapp H300e Firmware, Netapp H300s Firmware, Netapp H410s Firmware and 6 more.

How do I fix CVE-2021-42377?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-42377 being exploited?

There is no known exploitation of CVE-2021-42377 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-42377, GHSA-phvg-gc27-gjwp.