CVE-2021-38604

CVE	CVE-2021-38604
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-08-12 16:15:00 UTC
Updated	2023-11-07 03:37:00 UTC
Description	In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.

Problem Types: CWE-476

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Fedoraproject	Fedora	35	All	All	All
Application	Gnu	Glibc	All	All	All	All
Application	Oracle	Communications Cloud Native Core Binding Support Function	22.1.3	All	All	All
Application	Oracle	Communications Cloud Native Core Network Function Cloud Native Environment	22.1.0	All	All	All
Application	Oracle	Communications Cloud Native Core Network Repository Function	22.1.2	All	All	All
Application	Oracle	Communications Cloud Native Core Network Repository Function	22.2.0	All	All	All
Application	Oracle	Communications Cloud Native Core Security Edge Protection Proxy	22.1.1	All	All	All
Application	Oracle	Communications Cloud Native Core Unified Data Repository	22.2.0	All	All	All
Application	Oracle	Enterprise Operations Monitor	4.3	All	All	All
Application	Oracle	Enterprise Operations Monitor	4.4	All	All	All
Application	Oracle	Enterprise Operations Monitor	5.0	All	All	All

Reference	Source	Link	Tags
[SECURITY] Fedora 35 Update: glibc-2.34-6.fc35 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
28213 – NULL pointer dereference due to CVE-2021-33574 fix	MISC	sourceware.org
sourceware.org Git - glibc.git/commit	MISC	sourceware.org
sourceware.org Git - glibc.git/commit		sourceware.org
CVE-2021-38604 GNU C Library (glibc) Vulnerability in NetApp Products \| NetApp Product Security	CONFIRM	security.netapp.com
TuxCare Team identifies CVE-2021-38604, a new vulnerability in glibc	MISC	blog.tuxcare.com
[SECURITY] Fedora 35 Update: glibc-2.34-6.fc35 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
sourceware.org Git - glibc.git/commit		sourceware.org
GNU C Library: Multiple Vulnerabilities (GLSA 202208-24) — Gentoo security	GENTOO	security.gentoo.org
sourceware.org Git - glibc.git/commit	MISC	sourceware.org
Oracle Critical Patch Update Advisory - July 2022	N/A	www.oracle.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

356765 Amazon Linux Security Advisory for glibc : ALAS2-2023-2371
591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
670818 EulerOS Security Update for glibc (EulerOS-SA-2021-2709)
670982 EulerOS Security Update for glibc (EulerOS-SA-2021-2684)
670992 EulerOS Security Update for glibc (EulerOS-SA-2021-2631)
671025 EulerOS Security Update for glibc (EulerOS-SA-2021-2660)
671255 EulerOS Security Update for glibc (EulerOS-SA-2022-1164)
710605 Gentoo Linux GNU C Library Multiple Vulnerabilities (GLSA 202208-24)
900311 CBL-Mariner Linux Security Update for glibc 2.28
901528 Common Base Linux Mariner (CBL-Mariner) Security Update for glibc (6442-1)
903129 Common Base Linux Mariner (CBL-Mariner) Security Update for glibc (5384)