CVE-2021-38604: Null Pointer Dereference
First published: Thu Aug 12 2021(Updated: )
In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU glibc | <=2.34 | |
| Fedoraproject Fedora | =35 | |
| Oracle Communications Cloud Native Core Binding Support Function | =22.1.3 | |
| Oracle Communications Cloud Native Core Network Function Cloud Native Environment | =22.1.0 | |
| Oracle Communications Cloud Native Core Network Repository Function | =22.1.2 | |
| Oracle Communications Cloud Native Core Network Repository Function | =22.2.0 | |
| Oracle Communications Cloud Native Core Security Edge Protection Proxy | =22.1.1 | |
| Oracle Communications Cloud Native Core Unified Data Repository | =22.2.0 | |
| Oracle Enterprise Operations Monitor | =4.3 | |
| Oracle Enterprise Operations Monitor | =4.4 | |
| Oracle Enterprise Operations Monitor | =5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
- https://security.gentoo.org/glsa/202208-24
- https://security.netapp.com/advisory/ntap-20210909-0005/
- https://sourceware.org/bugzilla/show_bug.cgi?id=28213
- https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
- https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=b805aebd42364fe696e417808a700fdb9800c9e8
- https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=4cc79c217744743077bf7a0ec5e0a4318f1e6641
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
Frequently Asked Questions
What is CVE-2021-38604?
CVE-2021-38604 is a vulnerability in the GNU C Library (glibc) that mishandles certain NOTIFY_REMOVED data, resulting in a NULL pointer dereference.
How severe is CVE-2021-38604?
CVE-2021-38604 has a severity rating of 7.5 (high).
Which software versions are affected by CVE-2021-38604?
GNU glibc up to version 2.34, Fedora 35, Oracle Communications Cloud Native Core Binding Support Function 22.1.3, Oracle Communications Cloud Native Core Network Function Cloud Native Environment 22.1.0, Oracle Communications Cloud Native Core Network Repository Function 22.1.2 and 22.2.0, VMware Spring Cloud Gateway 22.1.1, Oracle Communications Cloud Native Core Unified Data Repository 22.2.0, Oracle Enterprise Operations Monitor 4.3, 4.4, and 5.0.
How can I fix CVE-2021-38604?
Apply the necessary patches or updates provided by the respective software vendors to fix CVE-2021-38604.
Where can I get more information about CVE-2021-38604?
You can find more information about CVE-2021-38604 in the following references: [1] [2] [3].
- agent/references
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/author
- agent/weakness
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/gnu
- canonical/gnu glibc
- version/gnu glibc/2.34
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- vendor/oracle
- canonical/oracle communications cloud native core binding support function
- version/oracle communications cloud native core binding support function/22.1.3
- canonical/oracle communications cloud native core network function cloud native environment
- version/oracle communications cloud native core network function cloud native environment/22.1.0
- canonical/oracle communications cloud native core network repository function
- version/oracle communications cloud native core network repository function/22.1.2
- version/oracle communications cloud native core network repository function/22.2.0
- canonical/oracle communications cloud native core security edge protection proxy
- version/oracle communications cloud native core security edge protection proxy/22.1.1
- canonical/oracle communications cloud native core unified data repository
- version/oracle communications cloud native core unified data repository/22.2.0
- canonical/oracle enterprise operations monitor
- version/oracle enterprise operations monitor/4.3
- version/oracle enterprise operations monitor/4.4
- version/oracle enterprise operations monitor/5.0