What’s Vulnerable › Vulnerabilities
CVE-2024-33602: nscd: netgroup cache assumes NSS callback uses in-buffer strings
- Severity: high (CVSS 7.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-05-06 · updated 2026-06-17
- Weakness: CWE-466
Description
nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
Affected products
- Debian Linux: 10.0
- GNU C Library (glibc): from 2.15 before 2.40 — fixed in 2.40
- NetApp Element Software: all versions
- NetApp H300S Firmware: all versions
- NetApp H410C Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp Hci Bootstrap Os: all versions
- NetApp Solidfire & Hci Management Node: all versions
- NetApp Solidfire & Hci Storage Node: all versions
How to fix
Upgrade to a fixed version: GNU C Library (glibc) 2.40. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2024/07/22/5
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html
- https://security.netapp.com/advisory/ntap-20240524-0012/
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008
- http://www.openwall.com/lists/oss-security/2024/07/22/5
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html
- https://security.netapp.com/advisory/ntap-20240524-0012/
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
Get alerted when CVE-2024-33602 or the next vulnerability affects your stack