CVE-2021-42385 Use after free in busybox

High 7.2 Published 15 Nov 2021 Updated 3 Nov 2025

A use-after-free in BusyBox awk allows attackers to cause denial of service or potentially execute code via crafted patterns.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-42385?

CVE-2021-42385 is a high-severity use after free vulnerability in Fedoraproject Fedora, published on 15 Nov 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function

Weakness: CWE-416

Which versions are affected by CVE-2021-42385?

It affects 2 products.

Products include Busybox Busybox, Fedoraproject Fedora.

How do I fix CVE-2021-42385?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2021-42385 being exploited?

There is no known exploitation of CVE-2021-42385 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALPINE-CVE-2021-42385, AZL-6351, DEBIAN-CVE-2021-42385, GHSA-px6h-65pj-6gq3, UBUNTU-CVE-2021-42385.