CVE-2021-42376 vulnerability in Busybox and Other Products
Published on November 15, 2021
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.
Weakness Type
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.
Products Associated with CVE-2021-42376
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-42376 are published in these products:
Affected Versions
busybox:- Version unspecified and below 1.34.0 is affected.
Exploit Probability
EPSS
0.05%
Percentile
13.52%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.