Security readout for executives and security teams
Plain-English summary
BusyBox includes a small awk tool used in many Linux and embedded systems. This flaw can crash that tool, and sources say code execution may be possible, when it processes a crafted awk pattern. Business risk is highest for appliances, firmware, or automation paths that let privileged users or services pass untrusted input to BusyBox awk.
Executive priority
Treat this as a high-priority inventory and patch-management issue for embedded and appliance-heavy environments. Urgency is moderate unless BusyBox awk is reachable through privileged workflows processing untrusted input. Prioritize vendor updates and asset discovery over emergency response.
Technical view
CVE-2021-42379 is a CWE-416 use-after-free in BusyBox awk's next_input_file function. The CVSS 3.1 score is 7.2 high, with network attack vector but high privileges required. Impact is listed as denial of service and possible code execution. The source bundle does not provide precise affected versions or a universal fixed version.
Likely exposure
Exposure is likely in systems bundling BusyBox, especially embedded devices, appliances, firmware, and minimal Linux environments. Practical exposure depends on whether the awk applet is present and whether privileged local or service-level workflows process attacker-controlled awk patterns or inputs.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. The CVSS vector requires high privileges, which reduces broad internet-scale risk. Still, BusyBox's common use in devices makes vulnerable deployments easy to miss, especially where firmware inventories are weak.
Researcher notes
Key uncertainties are affected version boundaries, exploit reliability, and product-specific reachability. The CVE describes possible code execution but the provided bundle does not prove exploitation in the wild. Focus research on confirming awk applet presence, input control, privilege context, and downstream vendor patch status.
Mitigation direction
- Inventory systems, firmware, containers, and appliances that include BusyBox.
- Check vendor advisories for fixed BusyBox packages or firmware updates.
- Apply relevant OS, firmware, or appliance updates from trusted vendors.
- Avoid passing untrusted patterns or inputs into BusyBox awk workflows.
- Track downstream advisories from vendors using BusyBox in their products.
Validation and detection
- Confirm whether BusyBox awk is installed or enabled on target assets.
- Map detected BusyBox packages to vendor advisory status.
- Review SBOMs and firmware manifests for embedded BusyBox copies.
- Check automation paths for attacker-controlled input reaching awk.
- Document compensating controls where vendor fixes are unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-42379 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H1.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/CVE reference
- FEDORA-2021-5a95823596CVE reference · vendor-advisory
- FEDORA-2021-c52c0fe490CVE reference · vendor-advisory
- https://security.netapp.com/advisory/ntap-20211223-0002/CVE reference
- https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrogCVE reference
- https://lists.debian.org/debian-lts-announce/2025/01/msg00012.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.