Skip to main content

CVE-2021-38604: n/a in n/a

High
VulnerabilityCVE-2021-38604cvecve-2021-38604
Published: Thu Aug 12 2021 (08/12/2021, 15:43:34 UTC)
Source: CVE Database V5
Vendor/Project: n/a
Product: n/a

Description

In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.

AI-Powered Analysis

AILast updated: 07/08/2025, 13:58:10 UTC

Technical Analysis

CVE-2021-38604 is a high-severity vulnerability affecting the GNU C Library (glibc) up to version 2.34, specifically within the librt component responsible for real-time extensions. The flaw exists in the file sysdeps/unix/sysv/linux/mq_notify.c, where the handling of certain NOTIFY_REMOVED data is incorrect, leading to a NULL pointer dereference. This vulnerability was introduced inadvertently as a side effect of a previous fix for CVE-2021-33574. A NULL pointer dereference typically causes a program crash, resulting in a denial of service (DoS) condition. The vulnerability is remotely exploitable without requiring authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The impact is limited to availability, with no direct confidentiality or integrity compromise. No known exploits have been reported in the wild, and no official patches are linked in the provided data, although it is likely that later glibc versions address this issue. The vulnerability is categorized under CWE-476 (NULL Pointer Dereference), a common programming error that can cause application instability or crashes. Given the widespread use of glibc in Linux-based systems, this vulnerability potentially affects a broad range of applications and services relying on real-time messaging notification features.

Potential Impact

For European organizations, the impact of CVE-2021-38604 primarily manifests as potential denial of service conditions on Linux systems using affected versions of glibc. This could disrupt critical services, especially those relying on real-time messaging queues or inter-process communication mechanisms provided by librt. Industries such as telecommunications, finance, healthcare, and critical infrastructure operators that depend on high availability Linux servers may experience service interruptions. Although the vulnerability does not allow for data leakage or unauthorized code execution, the induced crashes could be exploited by attackers to cause operational downtime, impacting business continuity and service reliability. Given the vulnerability requires no authentication or user interaction, automated attacks could target exposed services, increasing risk. However, the absence of known exploits in the wild and the availability of newer glibc versions mitigate the immediate threat level if systems are kept up to date.

Mitigation Recommendations

European organizations should prioritize upgrading glibc to versions later than 2.34 where this vulnerability is addressed. If immediate upgrading is not feasible, organizations should audit and monitor applications using librt's mq_notify functionality to detect abnormal crashes or service disruptions. Implementing robust process supervision and automatic restart mechanisms can reduce downtime caused by potential exploitation. Network-level protections such as firewall rules and intrusion detection systems should be configured to limit exposure of services that utilize real-time messaging features to untrusted networks. Additionally, organizations should review their incident response plans to include scenarios involving denial of service due to library-level faults. Close coordination with Linux distribution vendors for timely patch deployment and monitoring security advisories is essential. Finally, conducting internal vulnerability scans and penetration tests focusing on glibc versions can help identify at-risk systems.

Need more detailed analysis?Get Pro

Technical Details

Data Version
5.1
Assigner Short Name
mitre
Date Reserved
2021-08-12T00:00:00.000Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 683a06f1182aa0cae2bd9a52

Added to database: 5/30/2025, 7:28:49 PM

Last enriched: 7/8/2025, 1:58:10 PM

Last updated: 8/14/2025, 8:39:39 PM

Views: 17

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats