Bug 1965408 (CVE-2021-33574) - CVE-2021-33574 glibc: mq_notify does not handle separately allocated thread attributes
Summary: CVE-2021-33574 glibc: mq_notify does not handle separately allocated thread a...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-33574
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Red Hat1967864 Red Hat1967865 Red Hat1967866 Red Hat1967867 Red Hat1967872 Red Hat1967873 1965410 Red Hat1966471 Red Hat1966472 Red Hat1967868 Red Hat1967869 Red Hat1967870 Red Hat1967871 Red Hat1967874
Blocks: Embargoed1965409
TreeView+ depends on / blocked
 
Reported: 2021-05-27 16:32 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-11-08 13:14 UTC (History)
19 users (show)

Fixed In Version: glibc 2.34
Doc Type: If docs needed, set a value
Doc Text:
The mq_notify function in the GNU C Library (aka glibc) has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.
Clone Of:
Environment:
Last Closed: 2021-11-09 21:23:58 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4358 0 None None None 2021-11-09 18:28:18 UTC

Description Guilherme de Almeida Suckevicz 2021-05-27 16:32:24 UTC 
The mq_notify function in the GNU C Library (aka glibc) through 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=27896
Comment 1 Guilherme de Almeida Suckevicz 2021-05-27 16:34:11 UTC 
Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1965410]
Comment 2 Siddhesh Poyarekar 2021-05-31 06:42:00 UTC 
Sorry I missed this in my Mitre CVE report: the only use-after-free indirection is through the extensions member of struct pthread_attr (see sysdeps/nptl/internaltypes.h) and it got introduced in glibc-2.32.  As a result, only glibc-2.32 and glibc-2.33 are affected by this.
Comment 3 Siddhesh Poyarekar 2021-05-31 07:27:04 UTC 
(In reply to Siddhesh Poyarekar from comment #2)
> Sorry I missed this in my Mitre CVE report: the only use-after-free
> indirection is through the extensions member of struct pthread_attr (see
> sysdeps/nptl/internaltypes.h) and it got introduced in glibc-2.32.  As a
> result, only glibc-2.32 and glibc-2.33 are affected by this.

As I've corrected myself in the upstream bug, all earlier versions are affected.  Earlier versions dereference the cpuset member (which 'extensions' encapsulated in 2.32) which is dynamically allocated and hence has the same issue.
Comment 7 Huzaifa S. Sidhpurwala 2021-06-02 04:08:54 UTC 
Upstream commits: 

https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=42d359350510506b87101cf77202fefcbfc790cb
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=217b6dc298156bdb0d6aea9ea93e7e394a5ff091
Comment 12 errata-xmlrpc 2021-11-09 18:28:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4358 https://access.redhat.com/errata/RHSA-2021:4358
Comment 13 Product Security DevOps Team 2021-11-09 21:23:55 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-33574
Note You need to log in before you can comment on or make changes to this bug.