CVE-2021-38604
At a glance Severity HIGH 7.5 EPSS EPSS 3.72 % · percentile 90 (2026-10-27) State PUBLISHED Published 2021-08-12 Updated 2026-10-14 Assigner mitre NVD status Modified Description In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CISA-ADP CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 MEDIUM 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* ≤ 2.34cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_operations_monitor:4.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_operations_monitor:4.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_operations_monitor:5.0:*:*:*:*:*:*:*Affected products Product Versions affected n/a
References
Sources
