Executive brief
A vulnerability in the GNU C Library's Name Service Cache Daemon (nscd) can cause the service to crash. This component is responsible for speeding up network-related lookups like user and group information. If exploited, an attacker could cause a denial-of-service, disrupting system operations and network authentication services.
Technical details
A null pointer dereference vulnerability exists in the nscd binary of glibc. The flaw occurs when the daemon's cache fails to add a 'not-found' netgroup response to its internal cache. A subsequent client request for that same netgroup can trigger the dereference, resulting in a crash of the nscd process. This issue was introduced in glibc 2.15 and affects versions up to 2.39. While the attack vector is network-based, it requires a high complexity (AC:H) to trigger the specific cache failure state. Patches are available in glibc 2.40 and various backported stable releases.
Affected products
- GNU glibc 2.15 to 2.39
- Debian Debian Linux 10.0
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5
Timeline
- 2024-04-24: disclosed: Public date listed in glibc advisory
- 2024-05-06: advisory: NVD publication date
- 2024-06-30: patched: Debian LTS update released
- 2024-07-22: patched: glibc 2.40 released with fix
References
- http://www.openwall.com/lists/oss-security/2024/07/22/5
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html
- https://security.netapp.com/advisory/ntap-20240524-0013/
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html