Use-after-free in GNU C Library (glibc) - CVE-2021-33574

Vulnerability identifier: #VU54560

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33574

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the mq_notify() function in the GNU C Library. A remote attacker can force the library to use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service or possibly remote code execution.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

GNU C Library (glibc)
SIMATIC S7-1500 TM MFP - BIOS
Gentoo Linux
SUSE CaaS Platform
SUSE MicroOS
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
openEuler
Fedora
Cloud Pak for Security (CP4S)
RecoverPoint for Virtual Machines
Traffix SDC
IBM Integrated Analytics System
Red Hat OpenShift Serverless
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
Red Hat OpenStack
glibc-devel
glibc-debugsource
glibc-debuginfo-32bit
glibc-debuginfo
glibc-32bit
glibc
glibc-devel-32bit
glibc-devel-debuginfo
glibc-devel-debuginfo-32bit
glibc-locale
glibc-locale-32bit
glibc-locale-debuginfo
glibc-locale-debuginfo-32bit
glibc-profile
glibc-profile-32bit
nscd
nscd-debuginfo
glibc-html
glibc-i18ndata
glibc-info
glibc-devel-static
glibc-locale-base-32bit
glibc-locale-base
glibc-locale-base-debuginfo
glibc-extra
glibc-extra-debuginfo
glibc-utils
glibc-utils-debuginfo
glibc-utils-src-debugsource
glibc-32bit-debuginfo
glibc-devel-32bit-debuginfo
glibc-locale-base-32bit-debuginfo
glibc-common
glibc-help
glibc-nss-devel
glibc-locale-source
nss_modules
glibc-debugutils
glibc-benchtests
glibc-all-langpacks
libnsl
glibc (Red Hat package)
glibc-lang
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
SecurID Authentication Manager

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Cloud Pak for Security (CP4S) - update to 1.10.7.0
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
IBM Integrated Analytics System - update to 1.0.30.0
Red Hat OpenShift Serverless - update to 1.20.0
Red Hat Advanced Cluster Management for Kubernetes - update to 2.2.10
glibc-devel - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-debugsource - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-debuginfo-32bit - addressed in versions 2.22-114.15.1, 2.22-116.1
glibc-debuginfo - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-32bit - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-devel-32bit - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-devel-debuginfo - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-devel-debuginfo-32bit - addressed in versions 2.22-114.15.1, 2.22-116.1
glibc-locale - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-locale-32bit - addressed in versions 2.22-114.15.1, 2.22-116.1
glibc-locale-debuginfo - addressed in versions 2.22-114.15.1, 2.22-116.1
glibc-locale-debuginfo-32bit - addressed in versions 2.22-114.15.1, 2.22-116.1
glibc-profile - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-profile-32bit - addressed in versions 2.22-114.15.1, 2.22-116.1
nscd - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
nscd-debuginfo - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-html - addressed in versions 2.22-114.15.1, 2.22-116.1
glibc-i18ndata - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-info - addressed in versions 2.22-114.15.1, 2.22-116.1, 2.26-13.59.1, 2.31-9.3.2
glibc-devel-static - addressed in versions 2.22-114.15.1, 2.26-13.59.1, 2.31-9.3.2
glibc-locale-base-32bit - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-locale-base - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-locale-base-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-extra - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-extra-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-utils - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-utils-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-utils-src-debugsource - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-32bit-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-devel-32bit-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-locale-base-32bit-debuginfo - addressed in versions 2.26-13.59.1, 2.31-9.3.2
glibc-common - addressed in versions 2.28-69, 2.28-77
glibc-help - addressed in versions 2.28-69, 2.28-77
glibc-debugsource - addressed in versions 2.28-69, 2.28-77
nscd - addressed in versions 2.28-69, 2.28-77
glibc-nss-devel - addressed in versions 2.28-69, 2.28-77
glibc-debuginfo - addressed in versions 2.28-69, 2.28-77
glibc-devel - addressed in versions 2.28-69, 2.28-77
glibc-locale-source - addressed in versions 2.28-69, 2.28-77
nss_modules - addressed in versions 2.28-69, 2.28-77
glibc-debugutils - addressed in versions 2.28-69, 2.28-77
glibc-benchtests - addressed in versions 2.28-69, 2.28-77
glibc-all-langpacks - addressed in versions 2.28-69, 2.28-77
libnsl - addressed in versions 2.28-69, 2.28-77
glibc - addressed in versions 2.28-69, 2.28-77
glibc (Red Hat package) - update to 2.28-164.el8
glibc-lang - update to 2.31-9.3.2
glibc - addressed in versions 2.32-7.fc33, 2.32-8.fc33, 2.33-16.fc34, 2.33.9000-18.fc35
Red Hat Advanced Cluster Security for Kubernetes - update to 3.67
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
SecurID Authentication Manager - update to 8.6 Patch 1
Red Hat OpenStack - update to 16.2

• https://sourceware.org/bugzilla/show_bug.cgi?id=27896
• https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
• https://security.netapp.com/advisory/ntap-20210629-0005/

• Use-after-free in GNU C Library
• Gentoo update for glibc
• Denial of service in Traffix SDC glibc
• SUSE Linux Enterprise Server 11 update for glibc
• SUSE update for glibc
• SUSE update for glibc
• SUSE update for glibc
• SUSE update for glibc
• Red Hat Enterprise Linux 8 update for glibc
• Multiple vulnerabilities in Siemens SIMATIC S7-1500 TM MFP - BIOS
• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• openEuler 20.03 LTS SP1 update for glibc
• openEuler update for glibc
• IBM Integrated Analytics System update for glibc
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.67
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.20
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Fedora 33 update for glibc
• Fedora 34 update for glibc
• Fedora 35 update for glibc
• Fedora 33 update for glibc
• SecurID Authentication Manager update for third-party components
• Dell RecoverPoint for Virtual Machines update for third-party components
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.2