CVE-2024-33602: glibc (CVSS 7.4)

Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

Is your site exposed to CVE-2024-33602?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.4

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-466 CWE-466

Affected Products

Vendor	Product	Versions
gnu	glibc	2.15 — 2.40
debian	debian_linux	All
netapp	h300s_firmware	All
netapp	h300s	All
netapp	h500s_firmware	All
netapp	h500s	All
netapp	h700s_firmware	All
netapp	h700s	All
netapp	h410s_firmware	All
netapp	h410s	All
netapp	h410c_firmware	All
netapp	h410c	All
netapp	element_software	All
netapp	solidfire_\&_hci_management_node	All
netapp	solidfire_\&_hci_storage_node	All
netapp	hci_bootstrap_os	All

References

Other References

http://www.openwall.com/lists/oss-security/2024/07/22/5 https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html https://security.netapp.com/advisory/ntap-20240524-0012/ https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008 http://www.openwall.com/lists/oss-security/2024/07/22/5 https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html https://security.netapp.com/advisory/ntap-20240524-0012/ https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008 https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Frequently Asked Questions

What is CVE-2024-33602? +

nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary. It has a CVSS v3.1 base score of 7.4 (HIGH).

How severe is CVE-2024-33602? +

CVE-2024-33602 has a CVSS v3.1 score of 7.4 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-33602? +

CVE-2024-33602 affects products from debian, gnu, netapp, specifically: debian_linux, element_software, glibc, h300s, h300s_firmware, h410c, h410c_firmware, h410s, h410s_firmware, h500s, h500s_firmware, h700s, h700s_firmware, hci_bootstrap_os, solidfire_\&_hci_management_node, solidfire_\&_hci_storage_node. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-33602? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-21849 7.5

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause …

CVE-2026-57025 5.5

A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and …

CVE-2026-5450 9.8

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to …

CVE-2024-39331 9.8

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such …

CVE-2024-38428 9.1

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be …

CVE-2026-9155 8.8

OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via …

CVE-2024-33602