CVE-2021-33574

Published: 25 May 2021

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Notes

see https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c4
for a discussion on what pre-requisites are needed for an attack
based on this vulnerability.
affects more than just 2.32 and 2.33

upstream fix introduced CVE-2021-38604, if this CVE is fixed,
the other needs to be fixed also.
Fixing this CVE would require introducing new symbols which
will likely cause regressions for running systems. We will not
be fixing this CVE in Ubuntu stable releases. Marking as
ignored.

Status

Severity score breakdown

References

• https://sourceware.org/bugzilla/show_bug.cgi?id=27896
• https://www.cve.org/CVERecord?id=CVE-2021-33574
• NVD
• Launchpad
• Debian

Bugs

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989147