VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 27, 2015· Updated May 6, 2026

CVE-2014-8121

CVE-2014-8121

Description

DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A flaw in glibc's NSS 'files' backend allows remote attackers to cause a denial of service (infinite loop) by performing a lookup while iterating over a database.

Vulnerability

The vulnerability resides in the DB_LOOKUP function in nss_files/files-XXX.c of the GNU C Library (glibc) versions 2.21 and earlier. The function fails to properly check if a file descriptor is already open when performing lookups, leading to an infinite loop during simultaneous iteration and lookup operations. This issue affects all systems using the NSS "files" backend for services such as user and group databases [3].

Exploitation

An attacker can trigger this vulnerability by causing an application to interleave a key-based lookup (e.g., getpwuid) while iterating over the same NSS database (e.g., getpwent). This sequence resets the file pointer, causing the iteration to restart indefinitely. The attack can be performed remotely by sending crafted requests to a network service that uses NSS for authentication or user enumeration, such as Samba processing quota-related requests [2][3].

Impact

Successful exploitation results in an infinite loop, leading to a denial of service (DoS) condition. The affected application becomes unresponsive or hangs, potentially impacting system services. No elevation of privileges or data disclosure occurs [3].

Mitigation

The vulnerability is fixed in glibc version 2.22 (released February 2015) and in patched versions provided by distributors. Red Hat Enterprise Linux 7 received a fix in glibc-2.17-78.el7 (RHSA-2015-0327) [1]. Ubuntu issued updates in USN-2985-1 and USN-2985-2 [4]. Users should apply the latest updates from their operating system vendor. No workarounds are currently available [3].

References
  1. http://rhn.redhat.com/errata/RHSA-2015-0327.html
  2. [PATCH] CVE-2014-8121: Fix nss_files file management [BZ#18007]
  3. Unexpected closing of nss_files databases after lookups causes denial of service
  4. USN-2985-2: GNU C Library regression | Ubuntu security notices | Ubuntu

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

25

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.