5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-42364

CVE-2023-42364: A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service...

A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-42364

CVE-2023-42364:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description from NVD and GitHub Advisories directly points to the 'evaluate' function in 'awk.c' as the location of the use-after-free. While I couldn't fetch the specific commit details due to the BusyBox bug tracker being unavailable, the provided information is consistent and directly names the vulnerable function and file.

Ideally, I would inspect the patch from the bug tracker to confirm the exact lines of code changed within the evaluate function and any other related functions that might have been modified as part of the fix. This would provide stronger evidence and potentially reveal other functions involved in processing the malicious input or mitigating the vulnerability. However, without access to the patch, the analysis is based on the textual description of the vulnerability.

The evaluate function is highly likely to appear in a runtime profile during exploitation, as it's the core function processing the crafted pattern that triggers the use-after-free. Other functions called by evaluate or calling evaluate might also appear, but evaluate itself is the most direct indicator based on the current information.

Confidence is high because multiple sources (NVD, GHSA) corroborate that the vulnerability is in awk.c in the evaluate function. The lack of patch information prevents a deeper analysis of the code changes but doesn't negate the identification of the primary vulnerable function based on the descriptions provided.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.