High severity · published May 6, 2024
CVE-2024-33602
nscd: netgroup cache assumes NSS callback uses in-buffer strings
7.4
CVSS
0.4%
EPSS
No
On KEV
Description
nscd: netgroup cache assumes NSS callback uses in-buffer strings
The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory
when the NSS callback does not store all strings in the provided buffer.
The flaw was introduced in glibc 2.15 when the cache was added to nscd.
This vulnerability is only present in the nscd binary.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glibc · The GNU C Library
2.15 before 2.40 · source: vendor, NVD, CISA
DL
Debian Linux · Debian
10.0 · source: NVD
ES
Element Software · Netapp
All versions, or not specified · source: NVD
HF
H300s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H410c Firmware · Netapp
All versions, or not specified · source: NVD
HF
H410s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H500s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H700s Firmware · Netapp
All versions, or not specified · source: NVD
HB
Hci Bootstrap OS · Netapp
All versions, or not specified · source: NVD
SH
Solidfire & Hci Management Node · Netapp
All versions, or not specified · source: NVD
SH
Solidfire & Hci Storage Node · Netapp
All versions, or not specified · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.5; V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-33602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-33602
Mailing List
http://www.openwall.com/lists/oss-security/2024/07/22/5
Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240524-0012/
Broken Link
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
More from glibc
9.8
CVE-2026-5450
scanf %mc off-by-one heap buffer overflow
8.4
CVE-2026-0861
Integer overflow in memalign leads to heap corruption
8.1
CVE-2024-33599
nscd: Stack-based buffer overflow in netgroup cache
7.7
CVE-2026-19499
Buffer overflow in strfmon and strfmon_l right-justification padding
7.5
CVE-2026-5928
Potential buffer under-read in ungetwc