CVE-2021-33574

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
n/an/an/a
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5

References

Timeline

Published
May 25, 2021
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-335759.8The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of usinCVE-2021-335769.8An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-tCVE-2021-335775.3An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption andCVE-2021-335789.8Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticatCVE-2021-335807.5User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex eCVE-2021-335817.2MashZone NextGen through 10.7 GA has an SSRF vulnerability that allows an attacker to interact with arbitrary TCP services, by abusing the fCVE-2021-335827.5Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled duriCVE-2021-335839.8REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file.CVE-2021-335864.3InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "mCVE-2021-335877.5The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size CVE-2021-335897.5Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of CVE-2021-335909.8GattLib 0.3-rc1 has a stack-based buffer over-read in get_device_path_from_mac in dbus/gattlib.c.
CVE-2021-33574: Critical severity, CVSS 9.8 | Vulnix