Junglewise Threat Intelligence

CVE-2024-33602: GNU glibc memory corruption in nscd netgroup cache

CVE-2024-33602 · Severity: high · CVSS 7.4 · Published 2024-05-06

Technologies: Gnu Glibc. Vendors: Debian, Siemens, Gnu.

Executive brief

The Name Service Cache Daemon (nscd), a component of the GNU C Library used to speed up system lookups for users and groups, contains a memory corruption vulnerability. If an attacker can influence the data returned by a network directory service, they could potentially crash the system service or execute unauthorized code. This affects various Linux-based systems and industrial hardware that rely on this standard library component.

Technical details

A memory corruption vulnerability exists in the nscd binary within glibc's netgroup cache implementation. The root cause is that the netgroup cache logic assumes Name Service Switch (NSS) callbacks will always store returned strings within a provided buffer; however, the NSS API does not guarantee this behavior. When a callback returns strings outside the buffer, nscd's buffer resizing logic fails, leading to memory corruption. This can be triggered by a malicious or malformed response from a name service, potentially allowing for local privilege escalation or a denial-of-service (crash). The flaw was introduced in glibc 2.15 and is fixed in version 2.40 and various backported stable releases.

Affected products

  • GNU glibc 2.15 to 2.39
  • Debian nscd binary package 10.0 (buster)
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP firmware >= V3.1.5

Timeline

  • 2024-04-24: disclosed: Public disclosure date listed in glibc advisory
  • 2024-05-06: advisory: NVD publication date
  • 2024-07-22: patched: glibc 2.40 released with fix

References

Related threats