CVE-2021-33574
Description
The mq_notify function in the GNU C Library (aka glibc) has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.
Statement
In order to mount a minimal attack using this flaw, an attacker needs many pre-requisites to be able to even crash a program using this mq_notify bug:
- The program call to mq_notify needs to be controlled by the attacker
- The program must provide attributes to control creation of the notification thread in mq_notify
- The program must have the race condition where it may potentially destroy the notification thread attributes before the notification thread is created
- The program must set CPU affinity of the notification thread to actually cause the use-after-free dereference
There are no known applications that have all these pre-requisites.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | 9.8 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | High | N/A |
| Integrity Impact | None | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Mounting even a minimal attack using this vulnerability is quite hard. An attacker needs many pre-requisites to be able to even crash a program using this mq_notify bug, and there are no known applications that have all these pre-requisites.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
