CVE-2021-33574

Name of the Vulnerable Software and Affected Versions glibc versions 2.32 and 2.33

Description The issue is related to the mq notify function in the GNU C Library, which has a use-after-free problem. This occurs when the function uses the notification thread attributes object, passed through its struct sigevent parameter, after it has been freed by the caller. The exploitation of this issue may allow a remote attacker to cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts.

Recommendations For glibc versions 2.32 and 2.33, consider disabling the mq notify function as a temporary workaround until a patch is available. Restrict access to the mq notify function to minimize the risk of exploitation. Avoid using the struct sigevent parameter in the affected mq notify function until the issue is resolved.