CVE-2021-33574

CWE-416 — Use After FreeCWE-476 — NULL Pointer Dereference9 documents7 sources
Severity
9.8CRITICAL
EPSS
0.1%
top 69.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Netapp E-series Santricity OS ControllerDebian Debian LinuxFedoraproject Fedora+1 more
Timeline
PublishedMay 25
Latest updateMay 24

Description

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶Debianglibc< 2.31-13+deb11u3+3
▶NVDgnu/glibc2.32, 2.33+1

Also affects: Debian Linux 10.0, Fedora 33, 34

🔴Vulnerability Details

3
GHSA
GHSA-rx5m-j84j-22pg: The mq_notify function in the GNU C Library (aka glibc) through 2↗2022-05-24
▶
CVEList
CVE-2021-33574: The mq_notify function in the GNU C Library (aka glibc) versions 2↗2021-05-25
▶
OSV
CVE-2021-33574: The mq_notify function in the GNU C Library (aka glibc) versions 2↗2021-05-25
▶

📋Vendor Advisories

5
Microsoft
In librt in the GNU C Library (aka glibc) through 2.34 sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data leading to a NULL pointer dereference. NOTE: this vulnerability was in↗2021-08-10
▶
Red Hat
glibc: NULL pointer dereference in helper_thread() in mq_notify.c while handling NOTIFY_REMOVED messages↗2021-08-09
▶
Red Hat
glibc: mq_notify does not handle separately allocated thread attributes↗2021-05-21
▶
Microsoft
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter)↗2021-05-11
▶
Debian
CVE-2021-33574: glibc - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 h...↗2021
▶