CVE-2024-33600: nscd: Null pointer crashes after notfound response

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-06 · updated 2026-06-17
Weakness: CWE-476

Description

nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

Affected products

Debian Linux: 10.0
GNU C Library (glibc): from 2.15 before 2.40 — fixed in 2.40
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp H300S Firmware: all versions
NetApp H410C Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H610C Firmware: all versions
NetApp H610S Firmware: all versions
NetApp H615C Firmware: all versions
NetApp H700S Firmware: all versions
NetApp Hci Bootstrap Os: all versions

How to fix

Upgrade to a fixed version: GNU C Library (glibc) 2.40. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-33600 or the next vulnerability affects your stack