by Kastro
Paper/Archive/CVE-2021-33574

CVE-2021-33574

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP — The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free.

EPSS 4%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 89.2.892 × 2017.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsourceware.org/bugzilla/show_bug.cgi?id=27896refsourceware.org/bugzilla/show_bug.cgi?id=27896#c1advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUPrefsecurity.netapp.com/advisory/ntap-20210629-0005advisorysecurity.gentoo.org/glsa/202107-07advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDDreflists.debian.org/debian-lts-announce/2022/10/msg00021.htmlrefcert-portal.siemens.com/productcert/html/ssa-831302.htmlrefcert-portal.siemens.com/productcert/html/ssa-398330.html