Bug 1189426 (CVE-2021-38604)

Summary:	VUL-0: CVE-2021-38604: glibc: In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Marcus Meissner <meissner>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	lukas.lansky, meissner, ncutler, smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/307148/
Whiteboard:	CVSSv3.1:SUSE:CVE-2021-38604:6.2:(AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Marcus Meissner 2021-08-13 11:53:30 UTC

CVE-2021-38604

In librt in the GNU C Library (aka glibc) through 2.34,
sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data,
leading to a NULL pointer dereference. NOTE: this vulnerability was introduced
as a side effect of the CVE-2021-33574 fix.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-38604
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
https://sourceware.org/bugzilla/show_bug.cgi?id=28213

Comment 1 Marcus Meissner 2021-08-13 11:54:11 UTC

see bug 1186489

Comment 2 Andreas Schwab 2021-10-07 10:16:20 UTC

None of our products are affected.

Comment 3 Lukas Lansky 2021-10-26 13:26:37 UTC

(In reply to Andreas Schwab from comment #2)
> None of our products are affected.

Why? It seems to me glibc up to (including) 2.34 are affected. Thus Carwos (we get glibc from SUSE:SLE-15:Update) is affected. Or how should I understand this comment? Thanks.


Reason for asking: this CVE came up recently in the list of CVE from the customer they want some information about (e.g. it is or will it be fixed in Carwos etc.)

Comment 9 Marcus Meissner 2021-12-08 15:04:14 UTC

so just for completeness:

As we fixed the original CVE CVE-2021-33574,  bug 1186489, we have already folded in this followup fix into patch mq-notify-use-after-free.patch

Comment 10 Marcus Meissner 2022-11-25 09:55:49 UTC

released