CVE-2021-33574

Related Vulnerabilities: CVE-2021-33574  

The mq_notify function in the GNU C Library (aka glibc) has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Description

The mq_notify function in the GNU C Library (aka glibc) has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Additional Information

  • Bugzilla 1965408: CVE-2021-33574 glibc: mq_notify does not handle separately allocated thread attributes
  • CWE-416: Use After Free
  • FAQ: Frequently asked questions about CVE-2021-33574