PT-2021-5558 · Gnu+7 · Glibc+7
Florian Weimer
·
Published
2021-05-21
·
Updated
2025-05-30
·
CVE-2021-33574
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
glibc versions 2.32 and 2.33
Description
The issue is related to the
mq notify function in the GNU C Library, which has a use-after-free problem. This occurs when the function uses the notification thread attributes object, passed through its struct sigevent parameter, after it has been freed by the caller. The exploitation of this issue may allow a remote attacker to cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts.Recommendations
For glibc versions 2.32 and 2.33, consider disabling the
mq notify function as a temporary workaround until a patch is available. Restrict access to the mq notify function to minimize the risk of exploitation. Avoid using the struct sigevent parameter in the affected mq notify function until the issue is resolved.Exploit
Fix
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Red Hat
Rocky Linux
Suse
Glibc