CVE-2021-38604

Summary

CVE	CVE-2021-38604
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-08-12 16:15:10 UTC
Updated	2026-10-14 12:17:15 UTC
Description	In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-476 | n/a | CWE-476 CWE-476 NULL Pointer Dereference

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	ADP	DECLARED	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
2.0	[email protected]	Primary	5		`AV:N/AC:L/Au:N/C:N/I:N/A:P`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

AV:N/AC:L/Au:N/C:N/I:N/A:P

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Fedoraproject	Fedora	35	All	All	All
Application	Gnu	Glibc	All	All	All	All
Application	Oracle	Communications Cloud Native Core Binding Support Function	22.1.3	All	All	All
Application	Oracle	Communications Cloud Native Core Network Function Cloud Native Environment	22.1.0	All	All	All
Application	Oracle	Communications Cloud Native Core Network Repository Function	22.1.2	All	All	All
Application	Oracle	Communications Cloud Native Core Network Repository Function	22.2.0	All	All	All
Application	Oracle	Communications Cloud Native Core Security Edge Protection Proxy	22.1.1	All	All	All
Application	Oracle	Communications Cloud Native Core Unified Data Repository	22.2.0	All	All	All
Application	Oracle	Enterprise Operations Monitor	4.3	All	All	All
Application	Oracle	Enterprise Operations Monitor	4.4	All	All	All
Application	Oracle	Enterprise Operations Monitor	5.0	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified

References

Reference	Source	Link	Tags
cert-portal.siemens.com/productcert/html/ssa-398330.html	0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	cert-portal.siemens.com
TuxCare Team identifies CVE-2021-38604, a new vulnerability in glibc	af854a3a-2127-422b-91ae-364da2661108	blog.tuxcare.com	Exploit, Third Party Advisory
[SECURITY] Fedora 35 Update: glibc-2.34-6.fc35 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
GNU C Library: Multiple Vulnerabilities (GLSA 202208-24) — Gentoo security	af854a3a-2127-422b-91ae-364da2661108	security.gentoo.org	Third Party Advisory
cert-portal.siemens.com/productcert/html/ssa-831302.html	0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	cert-portal.siemens.com
Oracle Critical Patch Update Advisory - July 2022	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch, Third Party Advisory
sourceware.org Git - glibc.git/commit	af854a3a-2127-422b-91ae-364da2661108	sourceware.org
28213 – NULL pointer dereference due to CVE-2021-33574 fix	af854a3a-2127-422b-91ae-364da2661108	sourceware.org	Issue Tracking, Patch, Third Party Advisory
sourceware.org Git - glibc.git/commit	af854a3a-2127-422b-91ae-364da2661108	sourceware.org
CVE-2021-38604 GNU C Library (glibc) Vulnerability in NetApp Products \| NetApp Product Security	af854a3a-2127-422b-91ae-364da2661108	security.netapp.com	Third Party Advisory
[SECURITY] Fedora 35 Update: glibc-2.34-6.fc35 - package-announce - Fedora Mailing-Lists	MITRE	lists.fedoraproject.org
sourceware.org Git - glibc.git/commit	MITRE	sourceware.org
sourceware.org Git - glibc.git/commit	MITRE	sourceware.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

356765 Amazon Linux Security Advisory for glibc : ALAS2-2023-2371
591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
670818 EulerOS Security Update for glibc (EulerOS-SA-2021-2709)
670982 EulerOS Security Update for glibc (EulerOS-SA-2021-2684)
670992 EulerOS Security Update for glibc (EulerOS-SA-2021-2631)
671025 EulerOS Security Update for glibc (EulerOS-SA-2021-2660)
671255 EulerOS Security Update for glibc (EulerOS-SA-2022-1164)
710605 Gentoo Linux GNU C Library Multiple Vulnerabilities (GLSA 202208-24)
900311 CBL-Mariner Linux Security Update for glibc 2.28
901528 Common Base Linux Mariner (CBL-Mariner) Security Update for glibc (6442-1)
903129 Common Base Linux Mariner (CBL-Mariner) Security Update for glibc (5384)