CVE-2021-42377
CRITICAL
Published Nov 15, 20214y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Published Nov 15, 2021 4y ago
Last Modified Jun 17, 2026 2w ago
Description
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-590
CWE-763
Affected Products 21
| Vendor | Product | Version | Range |
|---|---|---|---|
| busybox | busybox | 1.33.0 | any |
| busybox | busybox | 1.33.1 | any |
| fedoraproject | fedora | 33 | any |
| fedoraproject | fedora | 34 | any |
| netapp | cloud_backup | * | any |
| netapp | hci_management_node | * | any |
| netapp | solidfire | * | any |
| netapp | h300s_firmware | * | any |
| netapp | h300s | * | any |
| netapp | h500s_firmware | * | any |
| netapp | h500s | * | any |
| netapp | h700s_firmware | * | any |
| netapp | h700s | * | any |
| netapp | h300e_firmware | * | any |
| netapp | h300e | * | any |
| netapp | h500e_firmware | * | any |
| netapp | h500e | * | any |
| netapp | h700e_firmware | * | any |
| netapp | h700e | * | any |
| netapp | h410s_firmware | * | any |
| netapp | h410s | * | any |
References 5
- claroty.com https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog
- jfrog.com https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
- security.netapp.com https://security.netapp.com/advisory/ntap-20211223-0002/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.