In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.

The version of glibc installed on the remote host is prior to 2.26-57. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2371 advisory.

    2023-12-14: CVE-2021-33574 was added to this advisory.

    The mq_notify function in the GNU C Library (aka glibc) has a use-after-free. It may use the notification     thread attributes object (passed through its struct sigevent parameter) after it has been freed by the     caller, leading to a denial of service (application crash) or possibly unspecified other impact.
    (CVE-2021-33574)

    In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles     certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was     introduced as a side effect of the CVE-2021-33574 fix. (CVE-2021-38604)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

  - In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles     certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was     introduced as a side effect of the CVE-2021-33574 fix. (CVE-2021-38604)

  - In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to     emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state     reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states 'the bug     cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to     require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.
    (CVE-2021-43396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202208-24 (GNU C Library: Multiple Vulnerabilities)

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

  - In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles     certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was     introduced as a side effect of the CVE-2021-33574 fix. (CVE-2021-38604)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

  -  Please review the referenced CVE identifiers for details.  (CVE-2021-3998)

  - glibc: Off-by-one buffer overflow/underflow in getcwd() (CVE-2021-3999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

  - In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles     certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was     introduced as a side effect of the CVE-2021-33574 fix. (CVE-2021-38604)

  - ** DISPUTED ** In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can     force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an     internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states     'the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which     ought to require a separate application bug to do so unintentionally. Hence there's no security impact to     the bug.' (CVE-2021-43396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-     based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with     a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the mention of 'Fixed for glibc 2.33' in the 26649 reference.
    (CVE-2020-29573)

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

  - In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles     certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was     introduced as a side effect of the CVE-2021-33574 fix. (CVE-2021-38604)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

  - In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles     certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was     introduced as a side effect of the CVE-2021-33574 fix. (CVE-2021-38604)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

  - In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles     certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was     introduced as a side effect of the CVE-2021-33574 fix. (CVE-2021-38604)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles     certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was     introduced as a side effect of the CVE-2021-33574 fix. (CVE-2021-38604)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

  - In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles     certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was     introduced as a side effect of the CVE-2021-33574 fix. (CVE-2021-38604)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the glibc package has been released.

ID	Name	Product	Family	Severity
186573	Amazon Linux 2 : glibc (ALAS-2023-2371)	Nessus	Amazon Linux Local Security Checks	critical
170800	EulerOS Virtualization 3.0.2.2 : glibc (EulerOS-SA-2023-1254)	Nessus	Huawei Local Security Checks	critical
164108	GLSA-202208-24 : GNU C Library: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
158289	EulerOS 2.0 SP3 : glibc (EulerOS-SA-2022-1164)	Nessus	Huawei Local Security Checks	critical
157986	EulerOS Virtualization 3.0.6.6 : glibc (EulerOS-SA-2022-1122)	Nessus	Huawei Local Security Checks	critical
157951	EulerOS Virtualization 3.0.6.0 : glibc (EulerOS-SA-2022-1066)	Nessus	Huawei Local Security Checks	critical
156498	EulerOS Virtualization 3.0.2.6 : glibc (EulerOS-SA-2021-2881)	Nessus	Huawei Local Security Checks	critical
156344	EulerOS Virtualization 3.0.2.0 : glibc (EulerOS-SA-2021-2820)	Nessus	Huawei Local Security Checks	critical
155532	EulerOS Virtualization 2.9.1 : glibc (EulerOS-SA-2021-2742)	Nessus	Huawei Local Security Checks	critical
155473	EulerOS Virtualization 2.9.0 : glibc (EulerOS-SA-2021-2766)	Nessus	Huawei Local Security Checks	critical
155291	EulerOS 2.0 SP9 : glibc (EulerOS-SA-2021-2684)	Nessus	Huawei Local Security Checks	high
155276	EulerOS 2.0 SP9 : glibc (EulerOS-SA-2021-2709)	Nessus	Huawei Local Security Checks	high
155141	EulerOS 2.0 SP5 : glibc (EulerOS-SA-2021-2660)	Nessus	Huawei Local Security Checks	critical
154789	EulerOS 2.0 SP8 : glibc (EulerOS-SA-2021-2631)	Nessus	Huawei Local Security Checks	high
153040	Photon OS 3.0: Glibc PHSA-2021-3.0-0295	Nessus	PhotonOS Local Security Checks	high
153034	Photon OS 4.0: Glibc PHSA-2021-4.0-0095	Nessus	PhotonOS Local Security Checks	high
152883	Photon OS 1.0: Glibc PHSA-2021-1.0-0428	Nessus	PhotonOS Local Security Checks	high
152880	Photon OS 2.0: Glibc PHSA-2021-2.0-0383	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2021-38604

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical

high

high

high

high

high