CVE-2021-33574

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Link	Resource
https://sourceware.org/bugzilla/show_bug.cgi?id=27896	Exploit Issue Tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1	Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20210629-0005/	Third Party Advisory
https://security.gentoo.org/glsa/202107-07	Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html	Mailing List Third Party Advisory

Configuration 1

cpe:2.3:a:gnu:glibc:2.33:*:*:*:*:*:*:* cpe:2.3:a:gnu:glibc:2.32:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

---

Published : 2021-05-25 10:15

Updated : 2022-11-08 01:27

---

NVD link : CVE-2021-33574

Mitre link : CVE-2021-33574

No products.

CWE-416