CVE-2021-42377: Critical severity busybox vulnerability
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-42377?
CVE-2021-42377 is a vulnerability in Busybox's hush applet that can lead to denial of service and possible code execution.
Which software versions are affected by CVE-2021-42377?
CVE-2021-42377 affects Busybox version 1.33.0 and 1.33.1, as well as Fedora versions 33 and 34.
What is the severity of CVE-2021-42377?
CVE-2021-42377 has a severity score of 9.8 (critical).
How can CVE-2021-42377 be exploited?
CVE-2021-42377 can be exploited by an attacker sending a crafted shell command containing the &&& string.
Are there any fixes or patches available for CVE-2021-42377?
Yes, patches and fixes are available for CVE-2021-42377. It is recommended to update to a patched version of Busybox or the affected software.