diff --git a/0073-fix-CVE-2021-33910.patch b/0073-fix-CVE-2021-33910.patch
new file mode 100644
index 0000000000000000000000000000000000000000..d4b7ed32d7be5c74699f5320f4ef4ad0973166ca
--- /dev/null
+++ b/0073-fix-CVE-2021-33910.patch
@@ -0,0 +1,72 @@
+From 441e0115646d54f080e5c3bb0ba477c892861ab9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Wed, 23 Jun 2021 11:46:41 +0200
+Subject: [PATCH] basic/unit-name: do not use strdupa() on a path
+
+The path may have unbounded length, for example through a fuse mount.
+
+CVE-2021-33910: attacked controlled alloca() leads to crash in systemd
+and
+ultimately a kernel panic. Systemd parses the content of
+/proc/self/mountinfo
+and each mountpoint is passed to mount_setup_unit(), which calls
+unit_name_path_escape() underneath. A local attacker who is able to
+mount a
+filesystem with a very long path can crash systemd and the whole system.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1970887
+
+The resulting string length is bounded by UNIT_NAME_MAX, which is 256.
+But we
+can't easily check the length after simplification before doing the
+simplification, which in turns uses a copy of the string we can write
+to.
+So we can't reject paths that are too long before doing the duplication.
+Hence the most obvious solution is to switch back to strdup(), as before
+7410616cd9dbbec97cf98d75324da5cda2b2f7a2.
+
+https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9
+
+---
+ src/basic/unit-name.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/src/basic/unit-name.c b/src/basic/unit-name.c
+index 4226f30..1b01af6 100644
+--- a/src/basic/unit-name.c
++++ b/src/basic/unit-name.c
+@@ -370,12 +370,13 @@ int unit_name_unescape(const char *f, char **ret) {
+ }
+ 
+ int unit_name_path_escape(const char *f, char **ret) {
+-        char *p, *s;
++        _cleanup_free_ char *p = NULL;
++        char *s;
+ 
+         assert(f);
+         assert(ret);
+ 
+-        p = strdupa(f);
++        p = strdup(f);
+         if (!p)
+                 return -ENOMEM;
+ 
+@@ -387,13 +388,9 @@ int unit_name_path_escape(const char *f, char **ret) {
+                 if (!path_is_normalized(p))
+                         return -EINVAL;
+ 
+-                /* Truncate trailing slashes */
++                /* Truncate trailing slashes and skip leading slashes */
+                 delete_trailing_chars(p, "/");
+-
+-                /* Truncate leading slashes */
+-                p = skip_leading_chars(p, "/");
+-
+-                s = unit_name_escape(p);
++                s = unit_name_escape(skip_leading_chars(p, "/"));
+         }
+         if (!s)
+                 return -ENOMEM;
+-- 
+2.23.0
+
diff --git a/systemd.spec b/systemd.spec
index 0f19bb1bdf500e441d2eba42e397df82a113eab1..e79480e54bf93e4630aae74e0c268de09cc3fee0 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -16,7 +16,7 @@
 Name:           systemd
 Url:            https://www.freedesktop.org/wiki/Software/systemd
 Version:        243
-Release:        36
+Release:        37
 License:        MIT and LGPLv2+ and GPLv2+
 Summary:        System and Service Manager
 
@@ -119,6 +119,7 @@ Patch0069:      0069-backport-journald-rework-end-of-line-marker-handling-to-use
 Patch0070:      0070-backport-journald-rework-pid-change-handling.patch
 Patch0071:      0071-backport-journald-enforce-longer-line-length-limit-during-set.patch
 Patch0072:      backport-execute-Fix-migration-from-DynamicUser-yes-to-no.patch
+Patch0073:      0073-fix-CVE-2021-33910.patch
 
 #openEuler
 Patch9002:      1509-fix-journal-file-descriptors-leak-problems.patch
@@ -1504,6 +1505,12 @@ fi
 %exclude /usr/share/man/man3/*
 
 %changelog
+* Wed Jul 21 2021 yangmingtai <yangmingtai@huawei.com> - 243-37
+- Type:cve
+- ID:CVE-2021-33910
+- SUG:NA
+- DESC:Fix CVE-2021-33910
+
 * Thu Jun 03 2021 ExtinctFire <shenyining_00@126.com> - 243-36
 - Type:bugfix
 - ID:NA