CVE Vulnerabilities

CVE-2021-42377

Free of Memory not on the Heap

Published: Nov 15, 2021 | Modified: Nov 21, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
6.4 MODERATE
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Ubuntu
LOW

An attacker-controlled pointer free in Busyboxs hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.

Weakness

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

Affected Software

Name Vendor Start Version End Version
Busybox Busybox 1.33.0 (including) 1.33.0 (including)
Busybox Busybox 1.33.1 (including) 1.33.1 (including)
Busybox Ubuntu trusty *
Busybox Ubuntu upstream *
Busybox Ubuntu xenial *

Potential Mitigations

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, glibc in Linux provides protection against free of invalid pointers.

References