CVE-2021-42380: Use After Free
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-42380?
CVE-2021-42380 is a use-after-free vulnerability in Busybox's awk applet that can lead to denial of service and potentially code execution.
Which software is affected by CVE-2021-42380?
Busybox versions 1.27.2-2ubuntu3.4, 1.30.1-4ubuntu6.4, 1.30.1-6ubuntu2.1, 1.30.1-6ubuntu3.1, 1.30.1-7ubuntu2, and 1.34.0 are affected.
How can CVE-2021-42380 be exploited?
An attacker can exploit CVE-2021-42380 by crafting a malicious awk pattern and passing it to the clrvar function of Busybox's awk applet, leading to the use-after-free vulnerability.
What is the severity of CVE-2021-42380?
The severity of CVE-2021-42380 is high, as it can result in denial of service and possible code execution.
How can I fix CVE-2021-42380?
To fix CVE-2021-42380, update Busybox to version 1.27.2-2ubuntu3.4, 1.30.1-4ubuntu6.4, 1.30.1-6ubuntu2.1, 1.30.1-6ubuntu3.1, 1.30.1-7ubuntu2, or 1.34.0 depending on the specific version in use.