CVE-2021-33574CWE-416

CVE-2021-33574

Critical · published May 26, 2021

CVSS v3.1
9.8
EPSS
4%
Percentile
89.2
In the wild
Unconfirmed
What it is

⚠️ A use-after-free in glibc could lead to application crashes like a waiter dropping your carefully prepared order! 🍽️ Think of this vulnerability like a waiter who tries to serve a dish that has already been taken away – it can lead to quite the kitchen disaster! In this case, the application might crash when it tries to access resources that are no longer available, leaving users in a lurch. If an application attempts to use a memory location that has already been freed, it could cause a denial of service, crashing the application. While the severity is currently unknown, allowing this to go unchecked could lead to unexpected behaviors or outages—definitely not what you want in a production environment!

Put simply

Think of this vulnerability like a waiter who tries to serve a dish that has already been taken away – it can lead to quite the kitchen disaster! In this case, the application might crash when it tries to access resources that are no longer available, leaving users in a lurch. The mq_notify function in glibc versions 2.32 and 2.33 has a use-after-free vulnerability. This flaw occurs when the function accesses the notification thread attributes after they have been freed by the caller, which can compromise stability.

What to do

If an application attempts to use a memory location that has already been freed, it could cause a denial of service, crashing the application. While the severity is currently unknown, allowing this to go unchecked could lead to unexpected behaviors or outages—definitely not what you want in a production environment! Update glibc to the latest patched version to address this issue. Always ensure that you follow secure coding practices to mitigate use-after-free vulnerabilities in your code. Regularly audit your dependencies for updates to stay secure! You've got this! With a quick update, you can keep your applications running smoothly and securely! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03522 · 89.2th percentile
Weakness
CWE-416 · Use After Free
Published
2021-05-26T02:15Z
Affected products (15)
ProductVersionsFixed in
gnu/glibcall versions—
gnu/glibcall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
netapp/cloud_backupall versions—
netapp/e-series_santricity_os_controller≥ 11.0, ≤ 11.70.1—
netapp/solidfire_baseboard_management_controller_firmwareall versions—
netapp/h300s_firmwareall versions—
netapp/h500s_firmwareall versions—
netapp/h700s_firmwareall versions—
netapp/h300e_firmwareall versions—
netapp/h500e_firmwareall versions—
netapp/h700e_firmwareall versions—
netapp/h410s_firmwareall versions—
debian/debian_linuxall versions—
References (16)
https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/ · [email protected]https://security.gentoo.org/glsa/202107-07 · [email protected]https://security.netapp.com/advisory/ntap-20210629-0005/ · [email protected]https://sourceware.org/bugzilla/show_bug.cgi?id=27896 · [email protected]https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1 · [email protected]https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202107-07 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20210629-0005/ · af854a3a-2127-422b-91ae-364da2661108https://sourceware.org/bugzilla/show_bug.cgi?id=27896 · af854a3a-2127-422b-91ae-364da2661108https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-831302.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 25 MAY 00:00Z
    The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free
    cvelistv5