CVE-2024-33602

Published: May 6, 2024Modified: Jun 17, 2026

7.4

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.4 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

Affected (11)

Products: Gnu: Glibc · Debian: Debian Linux · Netapp: H300s Firmware, H500s Firmware, H700s Firmware, H410s Firmware, H410c Firmware, Element Software, Solidfire & Hci Management Node, Solidfire & Hci Storage Node, Hci Bootstrap Os

1 product

1 product

9 products

Solidfire & Hci Management Node

Solidfire & Hci Storage Node

Hci Bootstrap Os

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Glibc	From 2.15 to 2.40

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration H

3 vulnerable

Vulnerable Software	Affected Versions
Netapp Element Software	All versions
Netapp Solidfire & Hci Management Node	All versions
Netapp Solidfire & Hci Storage Node	All versions

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Hci Bootstrap Os	All versions

Related CWEs

CWE-466

Return of Pointer Value Outside of Expected Range

A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference.

References (9)

http://www.openwall.com/lists/oss-security/2024/07/22/5

Source: 3ff69d7a-14f2-4f67-a097-88dee7810d18

Mailing List

https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html

Source: 3ff69d7a-14f2-4f67-a097-88dee7810d18

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20240524-0012/

Source: 3ff69d7a-14f2-4f67-a097-88dee7810d18

Third Party Advisory

https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008

Source: 3ff69d7a-14f2-4f67-a097-88dee7810d18

Broken Link

http://www.openwall.com/lists/oss-security/2024/07/22/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20240524-0012/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.