CVE-2021-42382: Use After Free
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvars function
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/busyboxto a version that resolves this vulnerability.Fixed in 1:1.35.0-4Fixed in 1:1.36.1-9
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-42382.
What is the title of the vulnerability?
The title of the vulnerability is 'A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function.'
What is the affected software?
The affected software is Busybox versions 1:1.27.2-2ubuntu3.4, 1:1.30.1-4ubuntu6.4, 1:1.30.1-6ubuntu2.1, 1:1.30.1-6ubuntu3.1, 1:1.30.1-7ubuntu2, 1.34.0, and Debian versions 1:1.30.1-4 to 1:1.30.1-6.
What is the severity of the vulnerability?
The severity of the vulnerability has not been specified.
Is there a fix available for the vulnerability?
Yes, there are fix remedies available for the affected software versions.