CVE-2021-33574

 

Published at: - 26-05-2021 12:15

Last modified: - 17-10-2022 08:15

Total changes: - 9

Description

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://sourceware.org/bugzilla/show_bug.cgi?id=27896
• https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
• FEDORA-2021-7ddb8b0537-Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210629-0005/
• GLSA-202107-07-Third Party Advisory
• FEDORA-2021-f29b4643c7-Mailing List, Third Party Advisory
• [debian-lts-announce] 20221017 [SECURITY] [DLA 3152-1] glibc security update-

 

Keywords

NVD

 

CVE-2021-33574

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures