CVE-2021-33574

The mq_notify function in the GNU C Library (aka glibc) has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

In order to mount a minimal attack using this flaw, an attacker needs many pre-requisites to be able to even crash a program using this mq_notify bug:

1. The program call to mq_notify needs to be controlled by the attacker
2. The program must provide attributes to control creation of the notification thread in mq_notify
3. The program must have the race condition where it may potentially destroy the notification thread attributes before the notification thread is created
4. The program must set CPU affinity of the notification thread to actually cause the use-after-free dereference

There are no known applications that have all these pre-requisites.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.