CVE-2021-33574

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.(CVE-2021-33574)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Arbitrary read in wordexp() (CVE-2021-35942)

• glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c (CVE-2021-27645)

• glibc: mq_notify does not handle separately allocated thread attributes (CVE-2021-33574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Arbitrary read in wordexp() (CVE-2021-35942)

• glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c (CVE-2021-27645)

• glibc: mq_notify does not handle separately allocated thread attributes (CVE-2021-33574)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• Adopt pthread_attr_copy functionality, test case is included
• CVE-2021-33574: avoid use-after-free vulnerability
• CVE-2021-35942: avoid out-of-bounds read via signed integer overflow in array index
• CVE-2021-38604: considered. No NULL pointer dereference is possible

• Adopt pthread_attr_copy functionality, test case is included
• CVE-2021-33574: avoid use-after-free vulnerability
• CVE-2021-35942: avoid out-of-bounds read via signed integer overflow in array index
• CVE-2021-38604: considered. No NULL pointer dereference is possible

• debian/patches/any/add-pthread-attr-copy.patch: adopt pthread_attr_copy functionality.
• debian/patches/any/add-test-for-pthread-attr-copy.patch: add test case for it.
• SECURITY UPDATE: Use-after-free in mq_notify
  • debian/patches/any/CVE-2021-33574.patch: use __pthread_attr_copy to completely duplicate thread attribute, avoid NULL pointer dereference in helper_thread as per CVE-2021-38604.
  • CVE-2021-33574
  • CVE-2021-38604
• SECURITY UPDATE: Out-of-bounds read in wordexp
  • debian/patches/any/CVE-2021-35942.patch: use strtoul and 'unsigned long' to prevent signed integer overflow in array index.
  • CVE-2021-35942

• debian/patches/any/add-pthread-attr-copy.patch: adopt pthread_attr_copy functionality.
• debian/patches/any/add-test-for-pthread-attr-copy.patch: add test case for it.
• SECURITY UPDATE: Use-after-free in mq_notify
  • debian/patches/any/CVE-2021-33574.patch: use __pthread_attr_copy to completely duplicate thread attribute, avoid NULL pointer dereference in helper_thread as per CVE-2021-38604.
  • CVE-2021-33574
  • CVE-2021-38604
• SECURITY UPDATE: Out-of-bounds read in wordexp
  • debian/patches/any/CVE-2021-35942.patch: use strtoul and 'unsigned long' to prevent signed integer overflow in array index.
  • CVE-2021-35942

• CVE-2021-27645: nscd: Fix double free in netgroupcache (#1927877)
• CVE-2021-33574: Deep copy pthread attribute in mq_notify (#1966472)
• CVE-2021-35942: wordexp: handle overflow in positional parameter number (#1979127)
• librt: fix NULL pointer dereference (#1966472)

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact (CVE-2021-33574).

Other fixes in this update:

• fix triggers so ldconfig is always run on both installing and uninstalling libs (mga#28797)
• Fix SXID_ERASE behavior in setuid programs [BZ#27471]

This update for glibc fixes the following issues:

• CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911)
• CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489)

This update was imported from the SUSE:SLE-15:Update update project.

This update for glibc fixes the following issues:

• CVE-2021-33574: Fixed use __pthread_attr_copy in mq_notify (bsc#1186489).
• CVE-2021-35942: Fixed wordexp handle overflow in positional parameter number (bsc#1187911).

These are all security issues fixed in the glibc-2.34-1.2 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489)
• CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911)

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911)
• CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489)

Also the following bug was fixed:

• Avoid concurrency problem in ldconfig (bsc#1117993)

This update for glibc fixes the following issues:

• CVE-2021-33574: Fixed a use-after-free possibility in mq_notify() (bsc#1186489)

This update for glibc fixes the following issues:

• CVE-2021-33574: Fixed use __pthread_attr_copy in mq_notify (bsc#1186489).
• CVE-2021-35942: Fixed wordexp handle overflow in positional parameter number (bsc#1187911).

This update for glibc fixes the following issues:

• CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911)
• CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489)