CVE-2021-33574

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-33574
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33574.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-33574
Downstream
BELL (1)
CLSA (5)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (3)
RHSA (1)
RLSA (1)
SUSE (5)
UBUNTU (1)
Related
ALSA (1)
openSUSE (3)
SUSE (5)
Published
2021-05-25T22:15:10Z
Modified
2026-08-28T11:45:28Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "11.0"
                },
                {
                    "last_affected":  "11.70.1"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "netapp:e-series_santricity_os_controller"
        },
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "10.0"
                },
                {
                    "last_affected":  "10.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "33"
                },
                {
                    "last_affected":  "33"
                },
                {
                    "introduced":  "34"
                },
                {
                    "last_affected":  "34"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "fedoraproject:fedora"
        }
    ]
}
References

Affected packages

Git / github.com/bminor/glibc

Affected ranges

Type
GIT
Repo
https://github.com/bminor/glibc
Events
Introduced
3de512be7ea6053255afed6154db9ee31d4e557a
Last Affected
9826b03b747b841f5fc6de2054bf1ef3f5c4bdf3
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:gnu:glibc:2.32:*:*:*:*:*:*:*",
        "cpe:2.3:a:gnu:glibc:2.33:*:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "2.32"
        },
        {
            "last_affected":  "2.32"
        },
        {
            "introduced":  "2.33"
        },
        {
            "last_affected":  "2.33"
        }
    ],
    "source":  "CPE_STRING"
}

Affected versions

2.*
2.32
2.33
glibc-2.*
glibc-2.32
glibc-2.32.9000
glibc-2.33

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33574.json"

Git / sourceware.org/git/glibc.git

Affected ranges

Type
GIT
Repo
https://sourceware.org/git/glibc.git
Events
Introduced
3de512be7ea6053255afed6154db9ee31d4e557a
Last Affected
9826b03b747b841f5fc6de2054bf1ef3f5c4bdf3
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:gnu:glibc:2.32:*:*:*:*:*:*:*",
        "cpe:2.3:a:gnu:glibc:2.33:*:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "2.32"
        },
        {
            "last_affected":  "2.32"
        },
        {
            "introduced":  "2.33"
        },
        {
            "last_affected":  "2.33"
        }
    ],
    "source":  "CPE_STRING"
}

Affected versions

2.*
2.32
2.33
glibc-2.*
glibc-2.32
glibc-2.32.9000
glibc-2.33

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33574.json"