CVEvulnerability
CVE-2024-33602
7.4 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-05-06
- Last modified
- 2026-06-17
- Assigner
- 3ff69d7a-14f2-4f67-a097-88dee7810d18
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.4 HIGH — CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-466
Description
nscd: netgroup cache assumes NSS callback uses in-buffer strings
The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory
when the NSS callback does not store all strings in the provided buffer.
The flaw was introduced in glibc 2.15 when the cache was added to nscd.
This vulnerability is only present in the nscd binary.
Affected configurations
• gnu glibc (>= 2.15 < 2.40)
• debian debian linux 10.0
• netapp h300s firmware
• netapp h500s firmware
• netapp h700s firmware
• netapp h410s firmware
• netapp h410c firmware
• netapp element software
• netapp solidfire \& hci management node
• netapp solidfire \& hci storage node
• netapp hci bootstrap os
Related
Weakness · CWE (1)
- CWE-466 Return of Pointer Value Outside of Expected Range weakness
References
- http://www.openwall.com/lists/oss-security/2024/07/22/5 Mailing List
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240524-0012/ Third Party Advisory
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008 Broken Link
- http://www.openwall.com/lists/oss-security/2024/07/22/5 Mailing List
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240524-0012/ Third Party Advisory
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008 Broken Link
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html cert-portal.siemens.com