VulnerabilityModified

CVE-2024-33599

HIGH 8.1EPSS 1.31%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.31% probability · 69th percentile
CISA KEV: Not listed
Weakness: CWE-121
Affected: gnu/glibc · debian/debian linux · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h410s firmware · netapp/h410c firmware · netapp/hci bootstrap os
Source: 3ff69d7a-14f2-4f67-a097-88dee7810d18

References

http://www.openwall.com/lists/oss-security/2024/07/22/5Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00026.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20240524-0011/Third Party Advisory
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005Broken Link
http://www.openwall.com/lists/oss-security/2024/07/22/5Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00026.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20240524-0011/Third Party Advisory
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005Broken Link
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.