glibc 2.32/2.33: use-after-free in mq_notify of the caller's notification thread attributes

Impact

mq_notify in glibc 2.32 and 2.33 may use the notification thread attributes object passed through its struct sigevent parameter after the caller has freed it. The documented consequence is a crash of the calling application, with other unspecified impact possible; nothing in the record demonstrates code execution. Exposure is limited to processes that actually use POSIX message queues with thread notification, which is uncommon in a GPU serving or training stack, so for most operators this is a stability item on two specific glibc releases rather than a security exposure. The NVD vector of network access with no privileges is not supported by the description - treat the realistic case as a local crash of one process.

Who can reach it

Local only in practice: requires a process on the host that calls mq_notify with SIGEV_THREAD and frees the attributes object, on glibc 2.32 or 2.33. glibc provides no remotely reachable entry point here.

What to do

Move off glibc 2.32/2.33 to a patched release or take the distribution backport (Debian LTS, Fedora, Gentoo GLSA 202107-07). Updating glibc requires restarting every process linked against it, so plan a drain and reboot of each node; given the thin real-world exposure this belongs in a routine maintenance window.

References

Related entries

• OpenSSL: SM2 decryption understates the required buffer, overflowing it by up to 62 bytesCVE-2021-3711 · OpenSSL EVP_PKEY_decrypt (SM2 plaintext buffer size calculation)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical
• Linux kernel (net/smc): The early link-group cleanup path deletes the list head instead of the link group, so the groupCVE-2021-47536 · Linux kernel (net/smc)Critical
• OpenSSL 3.0.4: memory corruption in 2048-bit RSA private-key operations on AVX512IFMA CPUsCVE-2022-2274 · OpenSSL 3.0.4 RSA implementation (AVX512IFMA path on x86_64)Critical