Is CVE-2024-33602 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-33602 being exploited in the wild.

How severe is CVE-2024-33602?

High severity, with a CVSS score of 7.4, published 6 May 2024.

Which products and versions are affected?

Debian Nscd 10.0 (buster); Gnu Glibc 2.15 to 2.39; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP firmware >= V3.1.5.

Is there a fix for CVE-2024-33602?

A patch was published on 2024-07-22: glibc 2.40 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-33602 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2024-33602?

Check whether you run Debian Nscd, Gnu Glibc or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-33602: GNU glibc memory corruption in nscd netgroup cache

CVE-2024-33602 · Severity: high · CVSS 7.4 · Published 2024-05-06

The Name Service Cache Daemon (nscd), a component of the GNU C Library used to speed up system lookups for users and groups, contains a memory corruption vulnerability. If an attacker can influence the data returned by a network directory service, they could potentially crash the system service or execute unauthorized code. This affects various Linux-based systems and industrial hardware that rely on this standard library component.

Technologies: Gnu Glibc. Vendors: Debian, Gnu, Siemens.

Quick answers

Is CVE-2024-33602 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-33602 being exploited in the wild.
How severe is CVE-2024-33602?: High severity, with a CVSS score of 7.4, published 6 May 2024.
Which products and versions are affected?: Debian Nscd 10.0 (buster); Gnu Glibc 2.15 to 2.39; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP firmware >= V3.1.5.
Is there a fix for CVE-2024-33602?: A patch was published on 2024-07-22: glibc 2.40 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-33602 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2024-33602?: Check whether you run Debian Nscd, Gnu Glibc or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory corruption vulnerability exists in the nscd binary within glibc's netgroup cache implementation. The root cause is that the netgroup cache logic assumes Name Service Switch (NSS) callbacks will always store returned strings within a provided buffer; however, the NSS API does not guarantee this behavior. When a callback returns strings outside the buffer, nscd's buffer resizing logic fails, leading to memory corruption. This can be triggered by a malicious or malformed response from a name service, potentially allowing for local privilege escalation or a denial-of-service (crash). The flaw was introduced in glibc 2.15 and is fixed in version 2.40 and various backported stable releases.

Affected products

GNU glibc 2.15 to 2.39
Debian nscd binary package 10.0 (buster)
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP firmware >= V3.1.5

Timeline

2024-04-24: disclosed: Public disclosure date listed in glibc advisory
2024-05-06: advisory: NVD publication date
2024-07-22: patched: glibc 2.40 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.