CVE-2024-33599

What it actually does

Stack-based buffer overflow in nscd when its fixed-size netgroup cache is exhausted followed by a netgroup lookup request, allowing out-of-bounds writes on the stack.

Why it matters to the business

Systems running the nscd daemon from affected glibc versions face risk of remote code execution or denial of service; the issue has low observed exploitation and no ransomware use, but organizations must still apply updates promptly to avoid potential compromise of name-service caching infrastructure.

How an attack unfolds

An attacker repeatedly issues NSS requests to exhaust nscd's netgroup cache, then sends a specially crafted netgroup query that triggers the overflow, potentially allowing control of the nscd process.

How to fix it

Upgrade glibc to the version containing commit 3d1aed874918c466a4477af1da35983ab036690e or later; disable or remove the nscd binary if netgroup caching is not required.

How to confirm the fix worked

Confirm the installed glibc package contains commit 3d1aed874918c466a4477af1da35983ab036690e; test nscd behavior under cache-exhaustion conditions with netgroup queries; verify nscd process remains stable.

Typical attack path

1. Identify hosts exposing or reachable to nscd via local or network NSS queries
2. Flood nscd with requests to exhaust the fixed-size netgroup cache
3. Send crafted netgroup lookup that overflows the stack buffer
4. Achieve code execution or crash within the nscd process

How to detect it

Review system logs for nscd crashes or segmentation faults following high volumes of NSS netgroup queries; inspect process memory dumps or core files for stack corruption artifacts around netgroup handling.

What your security team should do

• Apply the glibc update containing commit 3d1aed874918c466a4477af1da35983ab036690e as soon as packages are available
• Disable nscd where netgroup caching is unnecessary
• Monitor for nscd crashes or unusual NSS traffic patterns