CVE-2021-42385 – CVE-2021-42385 is a use-after-free vulnerabilit... (How to Fix)

Q: What is the severity of CVE-2021-42385?

CVE-2021-42385 has a CVSS score of 7.2 (HIGH). CVE-2021-42385 is a use-after-free vulnerability in BusyBox's awk applet that can be triggered by processing a specially crafted awk pattern. This vulnerability allows denial of service and potentially remote code execution. Systems using vulnerable BusyBox versions with awk functionality are affected, particularly embedded devices, routers, and Linux distributions that include BusyBox.

📋 TL;DR

CVE-2021-42385 is a use-after-free vulnerability in BusyBox's awk applet that can be triggered by processing a specially crafted awk pattern. This vulnerability allows denial of service and potentially remote code execution. Systems using vulnerable BusyBox versions with awk functionality are affected, particularly embedded devices, routers, and Linux distributions that include BusyBox.

💻 Affected Systems

Products:

BusyBox

Versions: BusyBox versions prior to 1.35.0

Operating Systems: Linux distributions with BusyBox, Embedded Linux systems, Network devices using BusyBox

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems where BusyBox awk applet is compiled and in use. Many BusyBox builds include awk by default.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with the privileges of the BusyBox process, potentially leading to full system compromise.

🟠

Likely Case

Denial of service through application crash, disrupting services that rely on BusyBox awk functionality.

🟢

If Mitigated

Limited impact if proper input validation and sandboxing are implemented, with only service disruption possible.

🌐 Internet-Facing: MEDIUM - Exploitation requires processing attacker-controlled input through awk, which may be exposed via web interfaces or network services.

🏢 Internal Only: MEDIUM - Internal systems using BusyBox awk for processing untrusted data remain vulnerable to authenticated or local attacks.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires crafting specific awk patterns and getting them processed by vulnerable BusyBox instances. Public proof-of-concept demonstrates crash/DoS.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: BusyBox 1.35.0 and later

Vendor Advisory: https://git.busybox.net/busybox/commit/?id=bd4c4a9d6c7b0cac3657566944efda6c2c5b5f7a

Restart Required: No

Instructions:

1. Update BusyBox to version 1.35.0 or later. 2. Recompile if using custom builds. 3. Replace existing BusyBox binary with patched version. 4. Test awk functionality after update.

🔧 Temporary Workarounds

Disable awk applet

linux

Remove or disable awk functionality from BusyBox build

Recompile BusyBox without awk support: make menuconfig (deselect awk)

Input validation

all

Validate awk patterns before processing

Implement input sanitization for awk pattern inputs in applications

🧯 If You Can't Patch

Restrict access to systems using BusyBox awk to trusted users only
Implement network segmentation to limit exposure of vulnerable systems

🔍 How to Verify

Check if Vulnerable:

Check BusyBox version: busybox --version | grep -q '1.3[0-4]' && echo 'VULNERABLE'

Check Version:

busybox --version

Verify Fix Applied:

Verify version is 1.35.0 or later: busybox --version | grep -q '1.3[5-9]\|1\.[4-9]' && echo 'PATCHED'

📡 Detection & Monitoring

Log Indicators:

BusyBox crash logs
Segmentation fault errors involving awk
Unexpected process termination of BusyBox

Network Indicators:

Unusual network traffic to services using BusyBox awk
Patterns containing crafted awk syntax in inputs

SIEM Query:

process.name:"busybox" AND event.action:"crashed" OR error.message:"segmentation fault"

📊 Metadata

CVE ID: CVE-2021-42385

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: November 15, 2021

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-42385, you might also want to check these: