A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4019 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4019-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     January 19, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : busybox     Version        : 1:1.30.1-6+deb11u1     CVE ID         : CVE-2021-28831 CVE-2021-42374 CVE-2021-42378 CVE-2021-42379                      CVE-2021-42380 CVE-2021-42381 CVE-2021-42382 CVE-2021-42384                      CVE-2021-42385 CVE-2021-42386 CVE-2022-48174 CVE-2023-42364                      CVE-2023-42365     Debian Bug     : 985674 999567 1059049 1059051 1059052

    Multiple vulnerabilities have been found in BusyBox, a lightweight     single-executable containing various Unix utilities, which potentially     allow attackers to cause denial of service, information leakage, or     arbitrary code execution through malformed gzip data, crafted LZMA     input or crafted awk patterns.

    CVE-2021-28831

        decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit         on the huft_build result pointer, with a resultant invalid free or         segmentation fault, via malformed gzip data.

    CVE-2021-42374

        An out-of-bounds heap read in Busybox's unlzma applet leads to         information leak and denial of service when crafted LZMA-compressed         input is decompressed. This can be triggered by any applet/format that

    CVE-2021-42378

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         getvar_i function

    CVE-2021-42379

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         next_input_file function

    CVE-2021-42380

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         clrvar function

    CVE-2021-42381

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         hash_init function

    CVE-2021-42382

        use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         getvar_s function

    CVE-2021-42384

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         handle_special function

    CVE-2021-42385

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         evaluate function

    CVE-2021-42386

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         nvalloc function

    CVE-2022-48174

        There is a stack overflow vulnerability in ash.c:6030 in busybox before         1.35. In the environment of Internet of Vehicles, this vulnerability can         be executed from command to arbitrary code execution.

    CVE-2023-42364

        A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to         cause a denial of service via a crafted awk pattern in the awk.c         evaluate function.

    CVE-2023-42365

        A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a         crafted awk pattern in the awk.c copyvar function.

    For Debian 11 bullseye, these problems have been fixed in version     1:1.30.1-6+deb11u1.

    We recommend that you upgrade your busybox packages.

    For the detailed security status of busybox please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/busybox

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a     crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a     crafted awk pattern in the awk.c evaluate function.(CVE-2023-42365)

    A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at     awk.c:1159.(CVE-2023-42366)

Tenable has extracted the preceding description block directly from the EulerOS busybox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a     crafted awk pattern in the awk.c evaluate function.(CVE-2023-42364)

    A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c     copyvar function.(CVE-2023-42365)

    A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at     awk.c:1159.(CVE-2023-42366)

Tenable has extracted the preceding description block directly from the EulerOS busybox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of busybox installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-42365 advisory.

  - A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c     copyvar function. (CVE-2023-42365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6961-1 advisory.

    It was discovered that BusyBox did not properly validate user input when performing certain arithmetic     operations. If a user or automated system were tricked into processing a specially crafted file, an     attacker could possibly use this issue to cause a denial of service, or execute arbitrary code.
    (CVE-2022-48174)

    It was discovered that BusyBox incorrectly managed memory when evaluating certain awk expressions. An     attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. This issue     only affected Ubuntu 24.04 LTS. (CVE-2023-42363, CVE-2023-42364, CVE-2023-42365)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
214387	Debian dla-4019 : busybox - security update	Nessus	Debian Local Security Checks	critical
214181	EulerOS 2.0 SP9 : busybox (EulerOS-SA-2025-1035)	Nessus	Huawei Local Security Checks	medium
214166	EulerOS 2.0 SP9 : busybox (EulerOS-SA-2025-1052)	Nessus	Huawei Local Security Checks	medium
214044	EulerOS 2.0 SP10 : busybox (EulerOS-SA-2025-1001)	Nessus	Huawei Local Security Checks	medium
214037	EulerOS 2.0 SP10 : busybox (EulerOS-SA-2025-1018)	Nessus	Huawei Local Security Checks	medium
205784	CBL Mariner 2.0 Security Update: busybox (CVE-2023-42365)	Nessus	MarinerOS Local Security Checks	medium
205548	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : BusyBox vulnerabilities (USN-6961-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2023-42365

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

critical