CVE-2021-38604: GNU Glibc Use-After-Free Vulnerability

CVE-2021-38604 Overview

CVE-2021-38604 is a NULL pointer dereference vulnerability in the GNU C Library (glibc) through version 2.34. The flaw exists in librt within the file sysdeps/unix/sysv/linux/mq_notify.c, where certain NOTIFY_REMOVED data is mishandled. This vulnerability was introduced as an unintended side effect of the fix for CVE-2021-33574, demonstrating how security patches can sometimes introduce new vulnerabilities.

Critical Impact

Remote attackers can trigger a denial of service condition by causing applications that rely on POSIX message queue notification functionality to crash through a NULL pointer dereference, potentially disrupting critical services across Linux-based infrastructure.

Affected Products

• GNU glibc (through version 2.34)
• Fedora 35
• Oracle Communications Cloud Native Core Binding Support Function 22.1.3
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment 22.1.0
• Oracle Communications Cloud Native Core Network Repository Function 22.1.2 and 22.2.0
• Oracle Communications Cloud Native Core Security Edge Protection Proxy 22.1.1
• Oracle Communications Cloud Native Core Unified Data Repository 22.2.0
• Oracle Enterprise Operations Monitor 4.3, 4.4, and 5.0

Discovery Timeline

• August 12, 2021 - CVE-2021-38604 published to NVD
• May 30, 2025 - Last updated in NVD database

Technical Details for CVE-2021-38604

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference). The flaw resides in the message queue notification handling code within librt, a library that provides POSIX real-time extensions. When processing NOTIFY_REMOVED data, the code fails to properly validate pointer state before dereferencing, leading to a crash condition.

The vulnerability can be exploited remotely without authentication or user interaction. When successfully triggered, the NULL pointer dereference causes the affected application to crash, resulting in a denial of service. While this vulnerability does not compromise confidentiality or integrity, it poses a significant availability risk for systems running affected glibc versions, particularly in enterprise environments where continuous service availability is critical.

Root Cause

The root cause of this vulnerability stems from the patch applied to address CVE-2021-33574. During the fix for that vulnerability, changes were made to the mq_notify.c file that inadvertently introduced improper handling of NOTIFY_REMOVED data structures. Specifically, the code path failed to account for scenarios where pointers could be NULL after certain notification removal operations, leading to an unguarded dereference that triggers a segmentation fault.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity. An attacker can craft specific conditions that trigger the NOTIFY_REMOVED code path with malformed or unexpected data states. Since the attack requires no privileges and no user interaction, any network-accessible application using glibc's message queue notification functionality could potentially be targeted. The attack results in application crashes, which in multi-threaded or service-oriented environments can cascade into broader system instability.

The exploitation mechanism involves triggering the vulnerable code path in mq_notify() where the NOTIFY_REMOVED handling occurs. When the notification thread processes removal events, it may encounter a state where expected data structures are NULL, and without proper validation, the subsequent dereference causes the process to terminate abnormally.

Detection Methods for CVE-2021-38604

Indicators of Compromise

• Unexpected application crashes with segmentation fault signals (SIGSEGV) in processes using message queue notifications
• Core dumps showing crash location within librt.so or mq_notify related functions
• Increased frequency of service restarts for applications utilizing POSIX message queues
• System logs showing repeated process terminations without clear application-level errors

Detection Strategies

• Monitor for segmentation fault signals in applications known to use glibc message queue functionality
• Implement crash monitoring and alerting for critical services to detect potential exploitation attempts
• Use library version scanning tools to identify systems running glibc versions through 2.34 that have not been patched
• Deploy runtime application self-protection (RASP) solutions capable of detecting NULL pointer dereference attempts

Monitoring Recommendations

• Enable core dump collection and analysis for applications using librt and message queue notifications
• Configure system monitoring to alert on abnormal process termination rates
• Implement application health checks that can detect and report on unexpected restarts
• Review system logs regularly for patterns consistent with denial of service attempts

How to Mitigate CVE-2021-38604

Immediate Actions Required

• Update glibc to a patched version that addresses CVE-2021-38604 immediately
• Prioritize patching for systems running Oracle Communications Cloud Native Core products and Oracle Enterprise Operations Monitor
• Assess exposure of systems using POSIX message queue functionality to untrusted network traffic
• Consider implementing network segmentation to limit exposure of vulnerable systems while patches are being deployed

Patch Information

The vulnerability has been addressed through patches committed to the glibc source repository. The relevant fixes can be found in commits 4cc79c217744 and b805aebd4236. For Oracle products, refer to the Oracle CPU July 2022 Security Alert. Fedora users should apply updates as described in the Fedora Package Announcement. Gentoo users should review GLSA 2022-08-24.

Workarounds

• If immediate patching is not feasible, consider temporarily disabling or limiting access to applications that utilize POSIX message queue notifications
• Implement application-level restart mechanisms to automatically recover from crashes while patches are being scheduled
• Deploy network-level controls to restrict access to vulnerable services from untrusted sources
• Use containerization or sandboxing to limit the impact of potential crashes on overall system stability

# Check current glibc version
ldd --version

# Verify if librt is being used by critical applications
lsof | grep librt.so

# Update glibc on Debian/Ubuntu systems
sudo apt-get update && sudo apt-get upgrade libc6

# Update glibc on RHEL/CentOS systems
sudo yum update glibc