In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://sourceware.org/bugzilla/show_bug.cgi?id=28213 Issue Tracking, Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=28213 Issue Tracking, Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · gnu, fedoraproject, oracleNVD modified 2026-10-14 12:17
Affected (CPE criteria) 11
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_operations_monitor:4.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_operations_monitor:4.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_operations_monitor:5.0:*:*:*:*:*:*:*
References 18
- https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
- https://security.gentoo.org/glsa/202208-24 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210909-0005/ Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=28213 Issue Tracking, Patch, Third Party Advisory
- https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=4cc79c217744743077bf7a0ec5e0a4318f1e6641
- https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=b805aebd42364fe696e417808a700fdb9800c9e8
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
- https://security.gentoo.org/glsa/202208-24 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210909-0005/ Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=28213 Issue Tracking, Patch, Third Party Advisory
- https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=4cc79c217744743077bf7a0ec5e0a4318f1e6641
- https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=b805aebd42364fe696e417808a700fdb9800c9e8
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html