TI-2021-18796 Aliases CVE-2021-42382 GHSA-xpm2-jxrf-prmx

Use after free in busybox

LOW 39CWE-416Published 2021-11-15 · Updated 2025-11-03

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02756 86th percentileScored 2026-11-07

Fix Fixed busybox (busybox): 1.34.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
busybox	busybox	before 1.34.0	1.34.0	Patch available	CNA

busybox Vendorbusybox Affected before 1.34.0 Fixed in 1.34.0 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:busybox:busybox::::::::	1.26.0 – 1.33.1	Vulnerable	busybox
cpe:2.3:o:fedoraproject:fedora:33:::::::*	33	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:34:::::::*	34	Vulnerable	Fedoraproject

cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:* Versions 1.26.0 – 1.33.1 Vulnerable ·busybox
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject

Remediation

Fix · CNA busybox (busybox) Fixed in 1.34.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2021-11-15
busybox — FEDORA-2021-c52c0fe490
14 records Highest priority Priority MEDIUM 2 MEDIUM, 12 LOW
Other records, highest priority first
- TI-2021-18788 Out-of-bounds read in busyboxPriority MEDIUM 57
- TI-2021-18791 An attacker-controlled pointer free in Busybox's hush applet leads to denial of service…Priority MEDIUM 48
- TI-2021-18800 Use after free in busyboxPriority LOW 39
Show all 14 records → Advisory →
Advisory · 2021-11-15
busybox — FEDORA-2021-5a95823596
14 records Highest priority Priority MEDIUM 2 MEDIUM, 12 LOW
Other records, highest priority first
- TI-2021-18788 Out-of-bounds read in busyboxPriority MEDIUM 57
- TI-2021-18791 An attacker-controlled pointer free in Busybox's hush applet leads to denial of service…Priority MEDIUM 48
- TI-2021-18800 Use after free in busyboxPriority LOW 39
Show all 14 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat Enterprise Linux 6

Timeline

2026-10-02 Threatist record created from CVE-2021-42382
2026-10-03 Alias added: GHSA-xpm2-jxrf-prmx

References

Advisory 4

Other 1

https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog

TI-2016-05394 The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote… CVSS 3.1HIGH 7.5
TI-2018-15900 Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget"… CVSS 3.1HIGH 8.1
TI-2018-15917 BusyBox project BusyBox wget version prior to commit… CVSS 3.1CRITICAL 9.8
TI-2016-01959 Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows… CVSS 3.1CRITICAL 9.8
TI-2025-37846 BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in… CVSS 3.1MEDIUM 6.5
TI-2023-22583 A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of… CVSS 3.1MEDIUM 5.5

See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences