CVE-2021-42386

2021-11-1500:00:00

ubuntu.com

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

61.3%

JSON

A use-after-free in Busybox’s awk applet leads to denial of service and
possibly code execution when processing a crafted awk pattern in the
nvalloc function

Notes

Author	Note
ccdm94	fix (importing awk.c from busybox version >= 1.34.0 due to large amount of changes made to the awk.c code) introduces a regression to busybox awk in xenial and earlier. Applying changes from the commit which prevents this regression from happening (237bedd499c) could result in further regressions being introduced to other applets in busybox. This happens because interfaces for applets are altered in this commit, and the calls to get them executed through busybox are modified. External applications which use busybox could end up with regressions as well because of this.

Author

Note

ccdm94

fix (importing awk.c from busybox version >= 1.34.0 due to large amount of changes made to the awk.c code) introduces a regression to busybox awk in xenial and earlier. Applying changes from the commit which prevents this regression from happening (237bedd499c) could result in further regressions being introduced to other applets in busybox. This happens because interfaces for applets are altered in this commit, and the calls to get them executed through busybox are modified. External applications which use busybox could end up with regressions as well because of this.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchbusybox< 1:1.27.2-2ubuntu3.4UNKNOWN
ubuntu20.04noarchbusybox< 1:1.30.1-4ubuntu6.4UNKNOWN
ubuntu21.04noarchbusybox< 1:1.30.1-6ubuntu2.1UNKNOWN
ubuntu21.10noarchbusybox< 1:1.30.1-6ubuntu3.1UNKNOWN
ubuntu22.04noarchbusybox< 1:1.30.1-7ubuntu2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	busybox	< 1:1.27.2-2ubuntu3.4	UNKNOWN
ubuntu	20.04	noarch	busybox	< 1:1.30.1-4ubuntu6.4	UNKNOWN
ubuntu	21.04	noarch	busybox	< 1:1.30.1-6ubuntu2.1	UNKNOWN
ubuntu	21.10	noarch	busybox	< 1:1.30.1-6ubuntu3.1	UNKNOWN
ubuntu	22.04	noarch	busybox	< 1:1.30.1-7ubuntu2	UNKNOWN