Is CVE-2024-33601 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-33601 being exploited in the wild.

How severe is CVE-2024-33601?

High severity, with a CVSS score of 7.3, published 6 May 2024.

Which products and versions are affected?

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5.

Is there a fix for CVE-2024-33601?

A patch was published on 2024-06-30: Debian LTS update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-33601 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-33601?

Check whether you run Debian Linux, Gnu Glibc, NetApp H300s or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-33601: GNU glibc denial of service in nscd netgroup cache

CVE-2024-33601 · Severity: high · CVSS 7.3 · Published 2024-05-06

The GNU C Library (glibc) contains a flaw in its Name Service Cache Daemon (nscd), a service used to speed up lookups for network resources and user groups. An attacker can trigger a memory allocation failure that causes the daemon to crash and stop responding. This results in a denial of service, potentially preventing users and applications from accessing network resources or logging into the system.

Technologies: Debian Linux, Gnu Glibc, NetApp H300s, NetApp H300s Firmware, NetApp H410c, NetApp H410c Firmware, NetApp H410s, NetApp H410s Firmware, NetApp H500s, NetApp H500s Firmware, NetApp H700s, NetApp H700s Firmware, NetApp Hci Bootstrap Os, NetApp Hci Compute Node, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Debian, Gnu, NetApp, Siemens.

Quick answers

Is CVE-2024-33601 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-33601 being exploited in the wild.
How severe is CVE-2024-33601?: High severity, with a CVSS score of 7.3, published 6 May 2024.
Which products and versions are affected?: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5.
Is there a fix for CVE-2024-33601?: A patch was published on 2024-06-30: Debian LTS update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-33601 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-33601?: Check whether you run Debian Linux, Gnu Glibc, NetApp H300s or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Name Service Cache Daemon (nscd) in glibc uses xmalloc or xrealloc within its netgroup cache implementation. These functions are designed to terminate the process if a memory allocation failure occurs. An attacker can exploit this by sending specific requests that trigger an out-of-memory (OOM) condition in the netgroup cache, leading to a daemon crash (Denial of Service). While xmalloc is used in other parts of nscd, those instances typically occur during startup; the netgroup cache usage is vulnerable because it can be triggered by client requests during runtime. The vulnerability was introduced in glibc 2.15 and is fixed in version 2.40 and various backported stable releases.

Affected products

GNU glibc 2.15 to 2.39
Debian Debian Linux 10.0
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP >= V3.1.5

Timeline

2024-04-24: disclosed: Public date for GLIBC-SA-2024-0007
2024-05-06: advisory: NVD published date
2024-06-30: patched: Debian LTS update released
2024-07-22: patched: glibc 2.40 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.