What’s Vulnerable › Vulnerabilities
CVE-2024-33601: nscd: netgroup cache may terminate daemon on memory allocation failure
- Severity: high (CVSS 7.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-05-06 · updated 2026-06-17
- Weakness: CWE-617
Description
nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
Affected products
- Debian Linux: 10.0
- GNU C Library (glibc): from 2.15 before 2.40 — fixed in 2.40
- NetApp H300S Firmware: all versions
- NetApp H410C Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H610C Firmware: all versions
- NetApp H610S Firmware: all versions
- NetApp H615C Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp Hci Bootstrap Os: all versions
How to fix
Upgrade to a fixed version: GNU C Library (glibc) 2.40. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2024/07/22/5
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html
- https://security.netapp.com/advisory/ntap-20240524-0014/
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007
- http://www.openwall.com/lists/oss-security/2024/07/22/5
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html
- https://security.netapp.com/advisory/ntap-20240524-0014/
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
Get alerted when CVE-2024-33601 or the next vulnerability affects your stack