CVE-2014-9984

What it actually does

Incorrect buffer size calculation in nscd when handling netgroup requests leads to memory corruption, enabling daemon crash or arbitrary code execution as the nscd process user.

Why it matters to the business

Systems relying on vulnerable glibc versions face risk of service outages or full host compromise via the name service cache daemon, with elevated urgency for internet-facing or multi-tenant environments despite low EPSS.

How an attack unfolds

An attacker sends specially crafted netgroup requests over the network to the nscd daemon; the flawed size computation triggers memory corruption that can be leveraged for code execution or denial of service.

How to fix it

Upgrade GNU C Library (glibc) to version 2.20 or later to correct the netgroup buffer size computation in nscd; disable or restrict nscd where feasible.

How to confirm the fix worked

Verify glibc package version is at least 2.20; perform functional testing of netgroup lookups and monitor nscd stability under load.

Typical attack path

1. Locate hosts running vulnerable nscd (glibc < 2.20)
2. Craft malicious netgroup request payload
3. Transmit request to trigger buffer miscalculation
4. Achieve memory corruption leading to crash or RCE

How to detect it

Review nscd process logs and system crash reports for unexpected terminations during netgroup handling; inspect network traffic for unusual netgroup queries.

• nscd segmentation fault
• nscd buffer overflow
• netgroup request processing failure

What your security team should do

• Prioritize glibc upgrade to 2.20+ across all affected systems
• Audit nscd usage and disable where not required
• Implement network segmentation or access controls around nscd ports if enabled
• Monitor for nscd crashes and anomalous netgroup activity