CVE-2021-33574
📋 TL;DR
This CVE describes a use-after-free vulnerability in the GNU C Library (glibc) mq_notify function affecting versions 2.32 and 2.33. Attackers could exploit this to cause denial of service (application crashes) or potentially achieve arbitrary code execution. Systems running applications that use POSIX message queues with glibc 2.32-2.33 are affected.
💻 Affected Systems
- GNU C Library (glibc)
📦 What is this software?
E Series Santricity Os Controller by Netapp
Fedora by Fedoraproject
Fedora by Fedoraproject
Glibc by Gnu
The GNU C Library (glibc) is the core C library for Linux systems, providing essential system calls and basic functions for all C programs. It is a fundamental component that nearly every Linux application depends on.
Learn more about Glibc →Glibc by Gnu
The GNU C Library (glibc) is the core C library for Linux systems, providing essential system calls and basic functions for all C programs. It is a fundamental component that nearly every Linux application depends on.
Learn more about Glibc →⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though this requires specific conditions and hasn't been demonstrated publicly.
Likely Case
Denial of service through application crashes, potentially disrupting services that use POSIX message queues.
If Mitigated
Limited impact with proper patching and minimal use of vulnerable mq_notify functionality.
🎯 Exploit Status
Exploitation requires control over the notification thread attributes object and specific timing conditions. No public exploits have been reported.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: glibc 2.34 and later, or backported patches for 2.32-2.33
Vendor Advisory: https://sourceware.org/bugzilla/show_bug.cgi?id=27896
Restart Required: Yes
Instructions:
1. Update glibc package using your distribution's package manager. 2. For Debian/Ubuntu: apt update && apt upgrade libc6. 3. For RHEL/CentOS: yum update glibc. 4. Restart affected applications or reboot system.
🔧 Temporary Workarounds
Disable mq_notify usage
linuxAvoid using mq_notify function in applications or disable POSIX message queue functionality where possible.
🧯 If You Can't Patch
- Implement strict network segmentation to limit exposure of affected systems
- Monitor for application crashes related to message queue operations and implement restart automation
🔍 How to Verify
Check if Vulnerable:
Check glibc version with: ldd --version | head -1Check Version:
ldd --version | head -1Verify Fix Applied:
Verify glibc version is 2.34+ or check with: strings /lib/x86_64-linux-gnu/libc.so.6 | grep 'GLIBC 2.3[2-3]' (should return no output if patched)📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults in processes using message queues
- Kernel logs showing memory corruption errors
Network Indicators:
- Unusual process termination patterns in systems using POSIX message queues
SIEM Query:
process.name: (*mq* OR *glibc*) AND event.type: (crash OR segmentation_fault)🔗 References
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
- https://security.gentoo.org/glsa/202107-07
- https://security.netapp.com/advisory/ntap-20210629-0005/
- https://sourceware.org/bugzilla/show_bug.cgi?id=27896
- https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
- https://security.gentoo.org/glsa/202107-07
- https://security.netapp.com/advisory/ntap-20210629-0005/
- https://sourceware.org/bugzilla/show_bug.cgi?id=27896
- https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
