CVE-2021-33574 is a critical use-after-free vulnerability in the mq_notify function of the GNU C Library (glibc) versions 2.32 and 2.33, affecting products like Debian and Fedora. With a CVSS score of 9.8, it presents a severe risk due to its network-based attack vector, low complexity, and potential for denial of service or other unspecified impacts. Despite its high severity, there is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.32CPE matchmatch criteria | cpe:2.3:a:gnu:glibc:2.32:*:*:*:*:*:*:* | ||
2.33CPE matchmatch criteria | cpe:2.3:a:gnu:glibc:2.33:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
glibc: mq_notify does not handle separately allocated thread attributes
May 21, 2021The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller leading to a denial of service (application crash) or possibly unspecified other impact.
May 11, 2021