[Bug librt/28213] New: NULL pointer dereference due to CVE-2021-33574 fix

["npv1310 at gmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=28213

            Bug ID: 28213
           Summary: NULL pointer dereference due to CVE-2021-33574 fix
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: librt
          Assignee: unassigned at sourceware dot org
          Reporter: npv1310 at gmail dot com
  Target Milestone: ---

Hello.
While investigating the upstream fix of the recent CVE-2021-33574, i've found
following problem:
Helper thread frees copied attribute on NOTIFY_REMOVED message received from
the OS kernel. Unfortunately, it fails to check whether copied attribute
actually exists (data.attr != NULL). This worked earlier because free() checks
passed pointer before actually attempting to release corresponding memory. But
__pthread_attr_destroy assumes pointer is not NULL. So passing NULL pointer to
__pthread_attr_destroy will result in segmentation fault. This scenario is
possible if notification->sigev_notify_attributes == NULL (which means default
thread attributes should be used).
Affected file: sysdeps/unix/sysv/linux/mq_notify.c
Affected function: helper_thread
Affected lineno: 137

-- 
You are receiving this mail because:
You are on the CC list for the bug.