CVE-2021-28831 — Improper Handling of Exceptional Conditions in Busybox

CWE-755 — Improper Handling of Exceptional ConditionsCWE-763 — Release of Invalid Pointer or Reference13 documents8 sources
Severity
7.5HIGHNVD
EPSS
1.0%
top 22.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
BusyboxDebian BusyboxDebian Linux+2 more
Timeline
PublishedMar 19
Latest updateSep 4

Description

decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶debiandebian/busybox< busybox 1:1.35.0-1 (bookworm)
▶Debianbusybox/busybox< 1:1.30.1-6+deb11u1+3
▶Ubuntubusybox/busybox< 1:1.27.2-2ubuntu3.4+5
▶NVDbusybox/busybox1.32.0 — 1.32.1

Also affects: Debian Linux 9.0, Fedora 32, 33, 34

Patches

Patch: git.busybox.net ↗Patch: git.busybox.net ↗

🔴Vulnerability Details

5
OSV
busybox vulnerabilities↗2023-09-04
▶
GHSA
GHSA-7w53-225r-6vxv: decompress_gunzip↗2022-05-24
▶
OSV
busybox vulnerability↗2022-05-10
▶
OSV
busybox vulnerabilities↗2021-12-07
▶
OSV
CVE-2021-28831: decompress_gunzip↗2021-03-19
▶

📋Vendor Advisories

7
Ubuntu
BusyBox vulnerabilities↗2023-09-04
▶
CISA ICS
Siemens SIMATIC S7-1500 TM MFP BIOS↗2023-06-15
▶
Ubuntu
BusyBox vulnerability↗2022-05-10
▶
Ubuntu
BusyBox vulnerabilities↗2021-12-07
▶
Red Hat
busybox: invalid free or segmentation fault via malformed gzip data↗2021-03-12
▶