CVE-2021-42378

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.

Security Fix(es):

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function(CVE-2021-42382)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function(CVE-2021-42381)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function(CVE-2021-42380)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function(CVE-2021-42385)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function(CVE-2021-42378)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function(CVE-2021-42379)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function(CVE-2021-42383)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function(CVE-2021-42384)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function

• SECURITY UPDATE: use-after-free in concat op
  • debian/patches/CVE-awk-use-after-free.patch: second reference to a field reallocs/moves Fields[] array, but first ref still tries to use the element where it was before move.
  • CVE-2021-42378
  • CVE-2021-42379
  • CVE-2021-42380
  • CVE-2021-42381
  • CVE-2021-42382
  • CVE-2021-42383
  • CVE-2021-42384
  • CVE-2021-42385
  • CVE-2021-42386
  • debian/patches/CVE-awk-printf-buffer-overflow.patch: printf buffer overflow.
  • No CVE assigned (but mentioned by upstream maintainer as important at http://lists.busybox.net/pipermail/busybox/2021-November/089328.html).

• SECURITY UPDATE: multiple vulnerabilities in AWK implementation
  • debian/patches/CVE-2021-423xx-awk.patch: fix issues with argument parsing, delete statement validation, length() parsing, post-increment/decrement on literals, expression handling, regex splitting, use-after-realloc, and maxfields underflow
  • CVE-2021-42378
  • CVE-2021-42379
  • CVE-2021-42380
  • CVE-2021-42381
  • CVE-2021-42382
  • CVE-2021-42384
  • CVE-2021-42385
  • CVE-2021-42386

A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input. (CVE-2021-42376)

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input. (CVE-2021-42377)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function. (CVE-2021-42378)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function. (CVE-2021-42379)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function. (CVE-2021-42380)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function. (CVE-2021-42381)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function. (CVE-2021-42382)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function. (CVE-2021-42383)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function. (CVE-2021-42384)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function. (CVE-2021-42385)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function. (CVE-2021-42386)

This update for busybox fixes the following issues:

• CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
• CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).
• CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
• CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
• CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
• CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
• CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).
• CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).
• CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).
• CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
• CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
• CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).
• CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).
• CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).
• CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).
• CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).
• CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).
• CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).
• CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).
• CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).
• CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).
• CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).
• CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).

This update for busybox fixes the following issues:

• CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
• CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).
• CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
• CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
• CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
• CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
• CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).
• CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).
• CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).
• CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
• CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
• CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).
• CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).
• CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).
• CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).
• CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).
• CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).
• CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).
• CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).
• CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).
• CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).
• CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).
• CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).

This update for busybox fixes the following issues:

• CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
• CVE-2015-9261: Fixed segfalts and application crashes in huft_build (bsc#1102912).
• CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).
• CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).
• CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
• CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).
• CVE-2017-15874: Fixed integer underflow in archival/libarchive/decompress_unlzma.c (bsc#1064978).
• CVE-2017-16544: Fixed Insufficient sanitization of filenames when autocompleting (bsc#1069412).
• CVE-2018-1000500 : Fixed missing SSL certificate validation in wget (bsc#1099263).
• CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).
• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
• CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).
• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).
• CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS when a section name is supplied but no page argument is given (bsc#1192869).
• CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to information leak and DoS when crafted LZMA-compressed input is decompressed (bsc#1192869).
• CVE-2021-42375: Fixed incorrect handling of a special element in ash leading to DoS when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters (bsc#1192869).
• CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS when processing a crafted shell command (bsc#1192869).
• CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading to DoS and possible code execution when processing a crafted shell command (bsc#1192869).
• CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_i function (bsc#1192869).
• CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the next_input_file function (bsc#1192869).
• CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the clrvar function (bsc#1192869).
• CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the hash_init function (bsc#1192869).
• CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the getvar_s function (bsc#1192869).
• CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the handle_special function (bsc#1192869).
• CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the evaluate function (bsc#1192869).
• CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly code execution when processing a crafted awk pattern in the nvalloc function (bsc#1192869).

This update for busybox fixes the following issues:

• Enable switch_root With this change virtme --force-initramfs works as expected.
• Enable udhcpc

busybox was updated to 1.35.0

• Adjust busybox.config for new features in find, date and cpio

• Annotate CVEs already fixed in upstream, but not mentioned in .changes yet:

• CVE-2017-16544 (bsc#1069412): Insufficient sanitization of filenames when autocompleting
• CVE-2015-9261 (bsc#1102912): huft_build misuses a pointer, causing segfaults
• CVE-2016-2147 (bsc#970663): out of bounds write (heap) due to integer underflow in udhcpc
• CVE-2016-2148 (bsc#970662): heap-based buffer overflow in OPTION_6RD parsing
• CVE-2016-6301 (bsc#991940): NTP server denial of service flaw
• CVE-2017-15873 (bsc#1064976): The get_next_block function in archival/libarchive/decompress_bunzip2.c has an Integer Overflow
• CVE-2017-15874 (bsc#1064978): archival/libarchive/decompress_unlzma.c has an Integer Underflow
• CVE-2019-5747 (bsc#1121428): out of bounds read in udhcp components
• CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386 (bsc#1192869) : v1.34.0 bugfixes
• CVE-2021-28831 (bsc#1184522): invalid free or segmentation fault via malformed gzip data
• CVE-2018-20679 (bsc#1121426): out of bounds read in udhcp
• CVE-2018-1000517 (bsc#1099260): Heap-based buffer overflow in the retrieve_file_data()
• CVE-2011-5325 (bsc#951562): tar directory traversal
• CVE-2018-1000500 (bsc#1099263): wget: Missing SSL certificate validation

This update for busybox fixes the following issues:

• CVE-2014-9645: Fixed loading of unwanted modules with / (bsc#914660).

• CVE-2017-16544: Fixed insufficient sanitization of filenames when autocompleting (bsc#1069412).

• CVE-2015-9261: Fixed huft_build misuses a pointer, causing segfaults (bsc#1102912).

• CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow in udhcpc (bsc#970663).

• CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing (bsc#970662).

• CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).

• CVE-2017-15873: Fixed integer overflow in get_next_block function in archival/libarchive/decompress_bunzip2.c (bsc#1064976).

• CVE-2017-15874: Fixed integer overflow in archival/libarchive/decompress_unlzma (bsc#1064978).

• CVE-2019-5747: Fixed out of bounds read in udhcp components (bsc#1121428).

• CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386: v1.34.0 bugfixes (bsc#1192869).

• CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data (bsc#1184522).

• CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).

• CVE-2018-1000517: Fixed heap-based buffer overflow in the retrieve_file_data() (bsc#1099260).

• CVE-2011-5325: Fixed tar directory traversal (bsc#951562).

• CVE-2018-1000500: Fixed missing SSL certificate validation in wget (bsc#1099263).

• Update to 1.35.0

  • awk: fix printf %%, fix read beyond end of buffer
  • chrt: silence analyzer warning
  • libarchive: remove duplicate forward declaration
  • mount: 'mount -o rw ....' should not fall back to RO mount
  • ps: fix -o pid=PID,args interpreting entire 'PID,args' as header
  • tar: prevent malicious archives with long name sizes causing OOM
  • udhcpc6: fix udhcp_find_option to actually find DHCP6 options
  • xxd: fix -p -r
  • support for new optoins added to basename, cpio, date, find, mktemp, wget and others

• Enable fdisk (jsc#CAR-16)

• Update to 1.34.1:

  • build system: use SOURCE_DATE_EPOCH for timestamp if available
  • many bug fixes and new features
  • touch: make FEATURE_TOUCH_NODEREF unconditional

• update to 1.33.1:

  • httpd: fix sendfile
  • ash: fix HISTFILE corruptio
  • ash: fix unset variable pattern expansion
  • traceroute: fix option parsing
  • gunzip: fix for archive corruption

• Update to version 1.33.0

  • many bug fixes and new features

• Update to version 1.32.1

  • fixes a case where in ash, 'wait' never finishes.

• prepare usrmerge (bsc#1029961)

• Enable testsuite and package it for later rerun (for QA, jsc#CAR-15)

• Update to version 1.31.1:

  • Bug fix release. 1.30.1 has fixes for dc, ash (PS1 expansion fix), hush, dpkg-deb, telnet and wget.

• Changes from version 1.31.0:

  • many bugfixes and new features.

• Add busybox-no-stime.patch: stime() has been deprecated in glibc 2.31 and replaced with clock_settime().

• update to 1.25.1:

  • fixes for hush, gunzip, ip route, ntpd

• includes changes from 1.25.0:

  • many added and expanded implementations of command options

• includes changes from 1.24.2:

  • fixes for build system (static build with glibc fixed), truncate, gunzip and unzip.

• Update to version 1.24.1

  • for a full list of changes see http://www.busybox.net/news.html

• Refresh busybox.install.patch

• Update to 1.23.2

  • for a full list of changes see http://www.busybox.net/news.html

• Cleaned up spec file with spec-cleaner

• Refreshed patches

• update to 1.22.1: Many updates and fixes for most included tools, see see http://www.busybox.net/news.html

It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated system were tricked into processing a specially crafted gzip archive, a remote attacker could use this issue to cause BusyBox to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-28831)

It was discovered that BusyBox incorrectly handled certain malformed LZMA archives. If a user or automated system were tricked into processing a specially crafted LZMA archive, a remote attacker could use this issue to cause BusyBox to crash, resulting in a denial of service, or possibly leak sensitive information. (CVE-2021-42374)

Vera Mens, Uri Katz, Tal Keren, Sharon Brizinov, and Shachar Menashe discovered that BusyBox incorrectly handled certain awk patterns. If a user or automated system were tricked into processing a specially crafted awk pattern, a remote attacker could use this issue to cause BusyBox to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386)