CVE-2021-38604: GNU Glibc Use-After-Free Vulnerability

CVE-2021-38604 Overview

CVE-2021-38604 is a NULL pointer dereference vulnerability in the GNU C Library (glibc) through version 2.34. The flaw exists in librt within the file sysdeps/unix/sysv/linux/mq_notify.c, where certain NOTIFY_REMOVED data is mishandled. This vulnerability was introduced as an unintended side effect of the fix for CVE-2021-33574, demonstrating how security patches can sometimes introduce new vulnerabilities.

Critical Impact
Remote attackers can trigger a denial of service condition by causing applications that rely on POSIX message queue notification functionality to crash through a NULL pointer dereference, potentially disrupting critical services across Linux-based infrastructure.

Affected Products

GNU glibc (through version 2.34)
Fedora 35
Oracle Communications Cloud Native Core Binding Support Function 22.1.3
Oracle Communications Cloud Native Core Network Function Cloud Native Environment 22.1.0
Oracle Communications Cloud Native Core Network Repository Function 22.1.2 and 22.2.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy 22.1.1
Oracle Communications Cloud Native Core Unified Data Repository 22.2.0
Oracle Enterprise Operations Monitor 4.3, 4.4, and 5.0

Discovery Timeline

August 12, 2021 - CVE-2021-38604 published to NVD
May 30, 2025 - Last updated in NVD database

Technical Details for CVE-2021-38604

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference). The flaw resides in the message queue notification handling code within librt, a library that provides POSIX real-time extensions. When processing NOTIFY_REMOVED data, the code fails to properly validate pointer state before dereferencing, leading to a crash condition.

The vulnerability can be exploited remotely without authentication or user interaction. When successfully triggered, the NULL pointer dereference causes the affected application to crash, resulting in a denial of service. While this vulnerability does not compromise confidentiality or integrity, it poses a significant availability risk for systems running affected glibc versions, particularly in enterprise environments where continuous service availability is critical.

Root Cause

The root cause of this vulnerability stems from the patch applied to address CVE-2021-33574. During the fix for that vulnerability, changes were made to the mq_notify.c file that inadvertently introduced improper handling of NOTIFY_REMOVED data structures. Specifically, the code path failed to account for scenarios where pointers could be NULL after certain notification removal operations, leading to an unguarded dereference that triggers a segmentation fault.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity. An attacker can craft specific conditions that trigger the NOTIFY_REMOVED code path with malformed or unexpected data states. Since the attack requires no privileges and no user interaction, any network-accessible application using glibc's message queue notification functionality could potentially be targeted. The attack results in application crashes, which in multi-threaded or service-oriented environments can cascade into broader system instability.

The exploitation mechanism involves triggering the vulnerable code path in mq_notify() where the NOTIFY_REMOVED handling occurs. When the notification thread processes removal events, it may encounter a state where expected data structures are NULL, and without proper validation, the subsequent dereference causes the process to terminate abnormally.

Detection Methods for CVE-2021-38604

Indicators of Compromise

Unexpected application crashes with segmentation fault signals (SIGSEGV) in processes using message queue notifications
Core dumps showing crash location within librt.so or mq_notify related functions
Increased frequency of service restarts for applications utilizing POSIX message queues
System logs showing repeated process terminations without clear application-level errors

Detection Strategies

Monitor for segmentation fault signals in applications known to use glibc message queue functionality
Implement crash monitoring and alerting for critical services to detect potential exploitation attempts
Use library version scanning tools to identify systems running glibc versions through 2.34 that have not been patched
Deploy runtime application self-protection (RASP) solutions capable of detecting NULL pointer dereference attempts

Monitoring Recommendations

Enable core dump collection and analysis for applications using librt and message queue notifications
Configure system monitoring to alert on abnormal process termination rates
Implement application health checks that can detect and report on unexpected restarts
Review system logs regularly for patterns consistent with denial of service attempts

How to Mitigate CVE-2021-38604

Immediate Actions Required

Update glibc to a patched version that addresses CVE-2021-38604 immediately
Prioritize patching for systems running Oracle Communications Cloud Native Core products and Oracle Enterprise Operations Monitor
Assess exposure of systems using POSIX message queue functionality to untrusted network traffic
Consider implementing network segmentation to limit exposure of vulnerable systems while patches are being deployed

Patch Information

The vulnerability has been addressed through patches committed to the glibc source repository. The relevant fixes can be found in commits 4cc79c217744 and b805aebd4236. For Oracle products, refer to the Oracle CPU July 2022 Security Alert. Fedora users should apply updates as described in the Fedora Package Announcement. Gentoo users should review GLSA 2022-08-24.

Workarounds

If immediate patching is not feasible, consider temporarily disabling or limiting access to applications that utilize POSIX message queue notifications
Implement application-level restart mechanisms to automatically recover from crashes while patches are being scheduled
Deploy network-level controls to restrict access to vulnerable services from untrusted sources
Use containerization or sandboxing to limit the impact of potential crashes on overall system stability

bash

# Check current glibc version
ldd --version

# Verify if librt is being used by critical applications
lsof | grep librt.so

# Update glibc on Debian/Ubuntu systems
sudo apt-get update && sudo apt-get upgrade libc6

# Update glibc on RHEL/CentOS systems
sudo yum update glibc