Security readout for executives and security teams
Plain-English summary
BusyBox includes an unlzma decompression component used in many Linux and embedded environments. This flaw can read past heap memory when crafted LZMA-compressed input is decompressed, potentially leaking information or crashing the process. The public bundle does not show CISA KEV listing or confirmed active exploitation.
Executive priority
Treat this as a moderate maintenance and exposure-management issue, not an emergency based on the provided evidence. Prioritize patching internet-adjacent appliances, embedded devices, and systems that process untrusted compressed files.
Technical view
CVE-2021-42374 is a CWE-125 out-of-bounds heap read in BusyBox's unlzma applet. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H, indicating local, high-complexity exploitation with low privileges and confidentiality plus availability impact.
Likely exposure
Exposure is most likely where BusyBox is installed and systems process LZMA-compressed content, including downstream Linux distributions and appliances covered by Fedora, Debian LTS, and NetApp advisories. The bundle lists BusyBox versions as unspecified, so confirm with vendor package or firmware data.
Exploitation context
The source bundle supports crafted compressed input causing information leak or denial of service during decompression. It does not support claims of remote exploitation, public weaponization, or active exploitation. KEV is false in the provided data.
Researcher notes
Key uncertainties are affected BusyBox version ranges and exact fixed versions. Validation should focus on downstream packaging and firmware provenance. Avoid assuming exploitability beyond the local, high-complexity CVSS vector and crafted-input decompression condition shown in the bundle.
Mitigation direction
- Apply BusyBox updates from your OS, firmware, or appliance vendor.
- Review Fedora, Debian LTS, and NetApp advisories for affected package or product status.
- Limit untrusted LZMA decompression on systems that do not require it.
- Prioritize embedded and appliance firmware where BusyBox may be bundled invisibly.
- Track vendor guidance if fixed upstream versions are unclear.
Validation and detection
- Inventory BusyBox binaries, packages, containers, and firmware images.
- Check whether unlzma or LZMA-handling applets are present and reachable.
- Compare installed package or firmware versions against vendor advisories.
- Review workflows that decompress user-supplied or partner-supplied archives.
- Use controlled regression testing for malformed compressed input handling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-42374 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H14.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/CVE reference
- FEDORA-2021-5a95823596CVE reference · vendor-advisory
- FEDORA-2021-c52c0fe490CVE reference · vendor-advisory
- https://security.netapp.com/advisory/ntap-20211223-0002/CVE reference
- https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrogCVE reference
- https://lists.debian.org/debian-lts-announce/2025/01/msg00012.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.