VYPR
← All advisories
High severity7.4NVD Advisory· Published May 6, 2024· Updated May 12, 2026

CVE-2024-33602

CVE-2024-33602

Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings

The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap memory corruption bug in nscd's netgroup cache, present since glibc 2.15, can be triggered when NSS callbacks do not store all strings in the expected buffer.

The Name Service Cache Daemon (nscd) in the GNU C Library (glibc) suffers from a heap memory corruption vulnerability in its netgroup cache implementation. The bug, introduced in glibc 2.15 when the netgroup cache was added, occurs because the cache incorrectly assumes that the NSS (Name Service Switch) callback function always stores all returned strings into the provided buffer [1]. When a callback violates this assumption, nscd can corrupt its internal memory structures.

An attacker can exploit this vulnerability without authentication if they can influence the netgroup data returned by the NSS backend (e.g., by controlling an LDAP server or by crafting network responses). The nscd process, which typically runs with elevated privileges (often as root), will cache the malformed data; subsequent queries can trigger the corruption while the daemon processes the cached netgroup entries [2]. No special access to the system is required beyond the ability to supply crafted netgroup responses.

Successful exploitation leads to memory corruption within the nscd process. This could cause a denial of service (crash of nscd) or, potentially, arbitrary code execution in the context of the nscd service. Because nscd often runs as root, a successful code execution attack could result in full system compromise [2]. The vulnerability has a CVSS v3 base score of 7.4 (High).

The flaw was fixed in glibc version 2.40, released on July 2024, which includes proper bounds checking and validation of NSS callback behavior [2]. Users of glibc versions 2.15 through 2.39 are advised to update to the latest version. For affected products such as Siemens SIMATIC S7-1500 CPUs (which integrate glibc), Siemens has released a security advisory with specific remediation steps [1]. No workaround is known; the only effective mitigation is to apply the patch or update nscd/glibc.

References
  1. SSA-082556
  2. security - GNU C Library version 2.40 released with 5 CVE fixes

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

705

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.