First published: Mon Nov 15 2021(Updated: )
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.
Credit: reefs@jfrog.com reefs@jfrog.com
Affected Software | Affected Version | How to fix |
---|---|---|
BusyBox | =1.33.0 | |
BusyBox | =1.33.1 | |
Red Hat Fedora | =33 | |
Red Hat Fedora | =34 | |
NetApp Cloud Backup | ||
NetApp SolidFire & HCI Management Node | ||
NetApp SolidFire & HCI Storage Node | ||
All of | ||
NetApp H300S Firmware | ||
NetApp H300S Firmware | ||
All of | ||
NetApp H500e Firmware | ||
NetApp H500e Firmware | ||
All of | ||
NetApp H700S | ||
NetApp H700S | ||
All of | ||
NetApp H300E | ||
NetApp H300E Firmware | ||
All of | ||
NetApp H500S Firmware | ||
NetApp H500e Firmware | ||
All of | ||
NetApp H700E | ||
NetApp H700E | ||
All of | ||
NetApp H410S | ||
NetApp H410S Firmware | ||
NetApp H300S Firmware | ||
NetApp H300S Firmware | ||
NetApp H500e Firmware | ||
NetApp H500e Firmware | ||
NetApp H700S | ||
NetApp H700S | ||
NetApp H300E | ||
NetApp H300E Firmware | ||
NetApp H500S Firmware | ||
NetApp H500e Firmware | ||
NetApp H700E | ||
NetApp H700E | ||
NetApp H410S | ||
NetApp H410S Firmware |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2021-42377 is a vulnerability in Busybox's hush applet that can lead to denial of service and possible code execution.
CVE-2021-42377 affects Busybox version 1.33.0 and 1.33.1, as well as Fedora versions 33 and 34.
CVE-2021-42377 has a severity score of 9.8 (critical).
CVE-2021-42377 can be exploited by an attacker sending a crafted shell command containing the &&& string.
Yes, patches and fixes are available for CVE-2021-42377. It is recommended to update to a patched version of Busybox or the affected software.