A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade busybox | Mar 26, 2024 | May 18, 2022 |
| Amazon_linux | — | Upgrade busybox | Jul 20, 2023 | May 18, 2022 |
| Debian | — | No solution existsUpgrade busybox | May 15, 2025 | May 18, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade busybox-help | Nov 3, 2022 | May 18, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade busybox-help | Nov 15, 2022 | May 18, 2022 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 18, 2022 |
| Suse | — | Upgrade busybox-adduserUpgrade busybox-sendmailUpgrade busybox-procpsUpgrade busybox-bzip2Upgrade busybox-manUpgrade busybox-hostnameUpgrade busybox-whoisUpgrade busybox-syslogdUpgrade busybox-edUpgrade busybox-viUpgrade busybox-timeUpgrade busybox-whichUpgrade busybox-psmiscUpgrade busybox-policycoreutilsUpgrade busyboxUpgrade busybox-net-toolsUpgrade busybox-gzipUpgrade busybox-ncurses-utilsUpgrade busybox-dos2unixUpgrade busybox-xzUpgrade busybox-gawkUpgrade busybox-tunctlUpgrade busybox-sedUpgrade busybox-staticUpgrade busybox-miscUpgrade busybox-bind-utilsUpgrade busybox-lessUpgrade busybox-attrUpgrade busybox-diffutilsUpgrade busybox-unzipUpgrade busybox-sharutilsUpgrade busybox-kbdUpgrade busybox-cpioUpgrade busybox-tarUpgrade busybox-sysvinit-toolsUpgrade busybox-iproute2Upgrade busybox-bcUpgrade busybox-linksUpgrade busybox-kmodUpgrade busybox-warewulf3Upgrade busybox-vlanUpgrade busybox-netcatUpgrade busybox-grepUpgrade busybox-util-linuxUpgrade busybox-wgetUpgrade busybox-tracerouteUpgrade busybox-selinux-toolsUpgrade busybox-tftpUpgrade busybox-coreutilsUpgrade busybox-iputilsUpgrade busybox-findutilsUpgrade busybox-testsuiteUpgrade busybox-telnetUpgrade busybox-shUpgrade busybox-patch | Dec 2, 2022 | May 18, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub