CVE-2021-38604

In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.(CVE-2021-38604)

In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.

• Adopt pthread_attr_copy functionality, test case is included
• CVE-2021-33574: avoid use-after-free vulnerability
• CVE-2021-35942: avoid out-of-bounds read via signed integer overflow in array index
• CVE-2021-38604: considered. No NULL pointer dereference is possible

• Adopt pthread_attr_copy functionality, test case is included
• CVE-2021-33574: avoid use-after-free vulnerability
• CVE-2021-35942: avoid out-of-bounds read via signed integer overflow in array index
• CVE-2021-38604: considered. No NULL pointer dereference is possible

• debian/patches/any/add-pthread-attr-copy.patch: adopt pthread_attr_copy functionality.
• debian/patches/any/add-test-for-pthread-attr-copy.patch: add test case for it.
• SECURITY UPDATE: Use-after-free in mq_notify
  • debian/patches/any/CVE-2021-33574.patch: use __pthread_attr_copy to completely duplicate thread attribute, avoid NULL pointer dereference in helper_thread as per CVE-2021-38604.
  • CVE-2021-33574
  • CVE-2021-38604
• SECURITY UPDATE: Out-of-bounds read in wordexp
  • debian/patches/any/CVE-2021-35942.patch: use strtoul and 'unsigned long' to prevent signed integer overflow in array index.
  • CVE-2021-35942

• debian/patches/any/add-pthread-attr-copy.patch: adopt pthread_attr_copy functionality.
• debian/patches/any/add-test-for-pthread-attr-copy.patch: add test case for it.
• SECURITY UPDATE: Use-after-free in mq_notify
  • debian/patches/any/CVE-2021-33574.patch: use __pthread_attr_copy to completely duplicate thread attribute, avoid NULL pointer dereference in helper_thread as per CVE-2021-38604.
  • CVE-2021-33574
  • CVE-2021-38604
• SECURITY UPDATE: Out-of-bounds read in wordexp
  • debian/patches/any/CVE-2021-35942.patch: use strtoul and 'unsigned long' to prevent signed integer overflow in array index.
  • CVE-2021-35942

The recent fix for CVE-2021-33574 released in MGASA-2021-0308 introduced a NULL pointer dereference because mq_notify.c mishandles certain NOTIFY_REMOVED data, that will result in segmentation fault. This update adds the missing NULL pointer check to resolve this issue (CVE-2021-38604).