CVE-2021-42377 – CVE-2021-42377 is a critical vulnerability in B... (How to Fix)

Q: What is the severity of CVE-2021-42377?

CVE-2021-42377 has a CVSS score of 9.8 (CRITICAL). CVE-2021-42377 is a critical vulnerability in BusyBox's hush shell applet where an attacker-controlled pointer free leads to denial of service and potential remote code execution when processing a crafted shell command containing the '&&&' string. This affects any system using vulnerable versions of BusyBox's hush shell, particularly embedded devices, routers, and IoT systems. Attackers could exploit this to crash systems or execute arbitrary code.

📋 TL;DR

CVE-2021-42377 is a critical vulnerability in BusyBox's hush shell applet where an attacker-controlled pointer free leads to denial of service and potential remote code execution when processing a crafted shell command containing the '&&&' string. This affects any system using vulnerable versions of BusyBox's hush shell, particularly embedded devices, routers, and IoT systems. Attackers could exploit this to crash systems or execute arbitrary code.

💻 Affected Systems

Products:

BusyBox

Versions: BusyBox versions before 1.34.0

Operating Systems: Linux-based systems, embedded Linux distributions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using BusyBox's hush shell (not ash). Common in embedded devices, routers, IoT devices, and minimal Linux distributions.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with root privileges leading to complete system compromise, data theft, and persistent backdoor installation.

🟠

Likely Case

Denial of service causing system crashes and instability, with potential for limited code execution in specific configurations.

🟢

If Mitigated

Contained impact with proper input validation and privilege separation, resulting in isolated process crashes without system-wide effects.

🌐 Internet-Facing: HIGH - BusyBox is commonly used in internet-facing embedded devices and routers where shell access might be exposed through web interfaces or services.

🏢 Internal Only: MEDIUM - Internal systems using BusyBox could be exploited by authenticated users or through lateral movement, but requires shell access.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires ability to inject shell commands containing '&&&' string. Public proof-of-concept demonstrates denial of service. Remote code execution requires specific memory layout conditions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: BusyBox 1.34.0 and later

Vendor Advisory: https://git.busybox.net/busybox/commit/?id=bd4c3a8a0b9c0c2c810b4c2aad372e7c6a8c9c7f

Restart Required: Yes

Instructions:

1. Update BusyBox to version 1.34.0 or later. 2. Rebuild and redeploy affected systems. 3. Restart services using BusyBox. 4. Verify the fix by testing with vulnerable command patterns.

🔧 Temporary Workarounds

Disable hush shell

linux

Replace BusyBox hush shell with alternative shell (ash, bash) if available

update-alternatives --config sh
ln -sf /bin/bash /bin/sh

Input filtering

all

Filter or sanitize shell command input to block '&&&' sequences

sed -i 's/&&&//g' input_file
validate input for shell metacharacters

🧯 If You Can't Patch

Implement strict input validation to block shell metacharacters and '&&&' sequences
Use privilege separation and run BusyBox processes with minimal privileges

🔍 How to Verify

Check if Vulnerable:

Test with command: busybox sh -c 'echo test &&& echo test'. If system crashes or shows abnormal behavior, it's vulnerable.

Check Version:

busybox --help | head -1 | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+'

Verify Fix Applied:

After patching, run the same test command. System should handle it normally without crashes.

📡 Detection & Monitoring

Log Indicators:

Process crashes of busybox or hush shell
Unusual shell command patterns containing '&&&'
Failed authentication attempts followed by shell commands

Network Indicators:

Unexpected shell command execution over network services
Traffic to/from embedded devices with command injection patterns

SIEM Query:

process_name:"busybox" AND (event_type:"crash" OR command_line:"*&&&*")

📊 Metadata

CVE ID: CVE-2021-42377

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-590

Published: November 15, 2021

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-42377, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Busybox by Busybox

Busybox by Busybox

Cloud Backup by Netapp

Fedora by Fedoraproject